/* TEMPLATE GENERATED TESTCASE FILE Filename: CWE416_Use_After_Free__malloc_free_char_01.c Label Definition File: CWE416_Use_After_Free__malloc_free.label.xml Template File: sources-sinks-01.tmpl.c */ /* * @description * CWE: 416 Use After Free * BadSource: Allocate data using malloc(), initialize memory block, and Deallocate data using free() * GoodSource: Allocate data using malloc() and initialize memory block * Sinks: * GoodSink: Do nothing * BadSink : Use data * Flow Variant: 01 Baseline * * */ #include "std_testcase.h" #include #ifndef OMITBAD void CWE416_Use_After_Free__malloc_free_char_01_bad() { char * data; /* Initialize data */ data = NULL; data = (char *)malloc(100*sizeof(char)); if (data == NULL) {exit(-1);} memset(data, 'A', 100-1); data[100-1] = '\0'; /* POTENTIAL FLAW: Free data in the source - the bad sink attempts to use data */ free(data); /* POTENTIAL FLAW: Use of data that may have been freed */ printLine(data); /* POTENTIAL INCIDENTAL - Possible memory leak here if data was not freed */ } #endif /* OMITBAD */ #ifndef OMITGOOD /* goodG2B uses the GoodSource with the BadSink */ static void goodG2B() { char * data; /* Initialize data */ data = NULL; data = (char *)malloc(100*sizeof(char)); if (data == NULL) {exit(-1);} memset(data, 'A', 100-1); data[100-1] = '\0'; /* FIX: Do not free data in the source */ /* POTENTIAL FLAW: Use of data that may have been freed */ printLine(data); /* POTENTIAL INCIDENTAL - Possible memory leak here if data was not freed */ } /* goodB2G uses the BadSource with the GoodSink */ static void goodB2G() { char * data; /* Initialize data */ data = NULL; data = (char *)malloc(100*sizeof(char)); if (data == NULL) {exit(-1);} memset(data, 'A', 100-1); data[100-1] = '\0'; /* POTENTIAL FLAW: Free data in the source - the bad sink attempts to use data */ free(data); /* FIX: Don't use data that may have been freed already */ /* POTENTIAL INCIDENTAL - Possible memory leak here if data was not freed */ /* do nothing */ ; /* empty statement needed for some flow variants */ } void CWE416_Use_After_Free__malloc_free_char_01_good() { goodG2B(); goodB2G(); } #endif /* OMITGOOD */ /* Below is the main(). It is only used when building this testcase on its own for testing or for building a binary to use in testing binary analysis tools. It is not used when compiling all the testcases as one application, which is how source code analysis tools are tested. */ #ifdef INCLUDEMAIN int main(int argc, char * argv[]) { /* seed randomness */ srand( (unsigned)time(NULL) ); #ifndef OMITGOOD printLine("Calling good()..."); CWE416_Use_After_Free__malloc_free_char_01_good(); printLine("Finished good()"); #endif /* OMITGOOD */ #ifndef OMITBAD printLine("Calling bad()..."); CWE416_Use_After_Free__malloc_free_char_01_bad(); printLine("Finished bad()"); #endif /* OMITBAD */ return 0; } #endif