CertC++-MEM35ΒΆ

Allocate sufficient memory for an object

Required inputs: IR

The types of integer expressions used as size arguments to malloc(), calloc(), realloc(), or aligned_alloc() must have sufficient range to represent the size of the objects to be stored. If size arguments are incorrect or can be manipulated by an attacker, then a buffer overflow may occur. Incorrect size arguments, inadequate range checking, integer overflow, or truncation can result in the allocation of an inadequately sized buffer.

Typically, the amount of memory to allocate will be the size of the type of object to allocate. When allocating space for an array, the size of the object will be multiplied by the bounds of the array. When allocating space for a structure containing a flexible array member, the size of the array member must be added to the size of the structure. (See MEM33-C. Allocate and copy structures containing a flexible array member dynamically.) Use the correct type of the object when computing the size of memory to allocate.

STR31-C. Guarantee that storage for strings has sufficient space for character data and the null terminator is a specific instance of this rule.

Noncompliant Code Example (Pointer)

In this noncompliant code example, inadequate space is allocated for a  struct tm object because the size of the pointer is being used to determine the size of the pointed-to object: 

#include <stdlib.h>
#include <time.h>
 
struct tm *make_tm(int year, int mon, int day, int hour,
                   int min, int sec) {
  struct tm *tmb;
  tmb = (struct tm *)malloc(sizeof(tmb));
  if (tmb == NULL) {
    return NULL;
  }
  *tmb = (struct tm) {
    .tm_sec = sec, .tm_min = min, .tm_hour = hour,
    .tm_mday = day, .tm_mon = mon, .tm_year = year
  };
  return tmb;
}
Compliant Solution (Pointer)

 In this compliant solution, the correct amount of memory is allocated for the  struct tm object. When allocating  space for a single object, passing the (dereferenced) pointer type to the sizeof operator is a simple way to allocate sufficient memory. Because the sizeof operator does not evaluate its operand, dereferencing an uninitialized or null pointer in this context is well-defined behavior. 

#include <stdlib.h>
#include <time.h>
 
struct tm *make_tm(int year, int mon, int day, int hour,
                   int min, int sec) {
  struct tm *tmb;
  tmb = (struct tm *)malloc(sizeof(*tmb));
  if (tmb == NULL) {
    return NULL;
  }
  *tmb = (struct tm) {
    .tm_sec = sec, .tm_min = min, .tm_hour = hour,
    .tm_mday = day, .tm_mon = mon, .tm_year = year
  };
  return tmb;
}
Noncompliant Code Example (Integer)

In this noncompliant code example, an array of  long is allocated and assigned to  p. The code attempts to check for unsigned integer overflow in compliance with  INT30-C. Ensure that unsigned integer operations do not wrap and also ensures that  len is not equal to zero. (See  MEM04-C. Beware of zero-length allocations.) However, because  sizeof(int) is used to compute the size, and not  sizeof(long), an insufficient amount of memory can be allocated on implementations where  sizeof(long) is larger than  sizeof(int), and filling the array can cause a heap buffer overflow. 

#include <stdint.h>
#include <stdlib.h>
 
void function(size_t len) {
  long *p;
  if (len == 0 || len > SIZE_MAX / sizeof(long)) {
    /* Handle overflow */
  }
  p = (long *)malloc(len * sizeof(int));
  if (p == NULL) {
    /* Handle error */
  }
  free(p);
}
Compliant Solution (Integer)

This compliant solution uses  sizeof(long) to correctly size the memory allocation: 

#include <stdint.h>
#include <stdlib.h>

void function(size_t len) {
  long *p;
  if (len == 0 || len > SIZE_MAX / sizeof(long)) {
    /* Handle overflow */
  }
  p = (long *)malloc(len * sizeof(long));
  if (p == NULL) {
    /* Handle error */
  }
  free(p);
}
Compliant Solution (Integer)

Alternatively,  sizeof(*p) can be used to properly size the allocation: 

#include <stdint.h>
#include <stdlib.h>
 
void function(size_t len) {
  long *p;
  if (len == 0 || len > SIZE_MAX / sizeof(*p)) {
    /* Handle overflow */
  }
  p = (long *)malloc(len * sizeof(*p));
  if (p == NULL) {
    /* Handle error */
  }
  free(p);
}
Risk Assessment

Providing invalid size arguments to memory allocation functions can lead to buffer overflows and the execution of arbitrary code with the permissions of the vulnerable process.

Rule Severity Likelihood Remediation Cost Priority Level
MEM35-C High Probable High P6 L2
Related Guidelines
Taxonomy Taxonomy item Relationship
CERT C Secure Coding Standard ARR01-C. Do not apply the sizeof operator to a pointer when taking the size of an array
INT31-C. Ensure that integer conversions do not result in lost or misinterpreted data 		Prior to 2018-01-12: CERT: Unspecified Relationship
CERT C Secure Coding Standard INT32-C. Ensure that operations on signed integers do not result in overflow Prior to 2018-01-12: CERT: Unspecified Relationship
CERT C Secure Coding Standard INT18-C. Evaluate integer expressions in a larger size before comparing or assigning to that size Prior to 2018-01-12: CERT: Unspecified Relationship
CERT C Secure Coding Standard MEM04-C. Beware of zero-length allocations Prior to 2018-01-12: CERT: Unspecified Relationship
ISO/IEC TR 24772:2013 Buffer Boundary Violation (Buffer Overflow) [HCB] Prior to 2018-01-12: CERT: Unspecified Relationship
ISO/IEC TS 17961:2013 Taking the size of a pointer to determine the size of the pointed-to type [sizeofptr] Prior to 2018-01-12: CERT: Unspecified Relationship
CWE 2.11 CWE-131, Incorrect Calculation of Buffer Size 2017-05-16: CERT: Rule subset of CWE
CWE 2.11 CWE-680 2017-05-18: CERT: Rule subset of CWE
CWE 2.11 CWE-789 2017-06-12: CERT: Partial overlap
Bibliography
[ Coverity 2007]
[ Drepper 2006] Section 2.1.1, "Respecting Memory Bounds"
[ Seacord 2013] Chapter 4, "Dynamic Memory Management"
Chapter 5, "Integer Security"
[ Viega 2005] Section 5.6.8, "Use of  sizeof() on a Pointer Type"
[ xorl 2009] CVE-2009-0587: Evolution Data Server Base64 Integer Overflows
Excerpt from SEI CERT C++ Coding Standard [https://cmu-sei.github.io/secure-coding-standards/sei-cert-c-coding-standard/rules/memory-management-mem/mem35-c], Copyright (C) 1995-2026 Carnegie Mellon University. See section 9.4. "3rd-Party Licenses" in the documentation for full details.

Possible Messages

Key

Text

Severity

Disabled

missing_malloc_size

Possibly wrong allocation size: no sizeof used, but sizeof on {} expected

None

False

wrong_malloc_size

Wrong allocation size: sizeof on {} used, but {} expected

None

False

Options