Memory Corruption Detection
Detection Workflow
- Identify memory operations: Find all malloc/free/realloc calls, stack buffer allocations, pointer arithmetic operations
- Trace memory usage: Use
xrefs_to to trace data, track pointer values through code, identify all access patterns
- Check bounds: Verify size calculations, check array index validation, assess pointer arithmetic safety
- Assess impact: Can corruption control execution? Is there information disclosure? Can corruption cause DoS?
Key Patterns
- Heap overflow: malloc() followed by unchecked writes, off-by-one errors, integer overflow in size calculations
- Stack smashing: large stack buffer allocations, unchecked array access, variable-length arrays, return address overwrites
- Pointer arithmetic: pointer arithmetic without bounds checking, array indexing with user-controlled indices, out-of-bounds pointer access
- Memory leaks: missing free() after malloc(), reference cycles, exception paths skipping cleanup
Output Format
Report with: id, type, subtype, severity, confidence, location, allocation (function, address, size), corruption (function, address, source), vulnerability, root cause, exploitable, attack scenario, mitigation.
Severity Guidelines
- CRITICAL: Memory corruption allowing code execution
- HIGH: Memory corruption with data corruption or DoS
- MEDIUM: Memory leaks or minor corruption
- LOW: Potential issues with limited impact
See Also
patterns.md - Detailed detection patterns and exploitation scenariosexamples.md - Example analysis cases and code samplesreferences.md - CWE references and mitigation strategies
1---2name: detecting-memory-corruption3description: Detects various memory corruption vulnerabilities beyond simple buffer overflows including heap overflow, stack smashing, and double free. Use when analyzing complex memory management, heap operations, or investigating memory safety issues.4---5
6# Memory Corruption Detection
7
8## Detection Workflow
9
101. **Identify memory operations**: Find all malloc/free/realloc calls, stack buffer allocations, pointer arithmetic operations
112. **Trace memory usage**: Use `xrefs_to` to trace data, track pointer values through code, identify all access patterns
123. **Check bounds**: Verify size calculations, check array index validation, assess pointer arithmetic safety
134. **Assess impact**: Can corruption control execution? Is there information disclosure? Can corruption cause DoS?
14
15## Key Patterns
16
17- Heap overflow: malloc() followed by unchecked writes, off-by-one errors, integer overflow in size calculations
18- Stack smashing: large stack buffer allocations, unchecked array access, variable-length arrays, return address overwrites
19- Pointer arithmetic: pointer arithmetic without bounds checking, array indexing with user-controlled indices, out-of-bounds pointer access
20- Memory leaks: missing free() after malloc(), reference cycles, exception paths skipping cleanup
21
22## Output Format
23
24Report with: id, type, subtype, severity, confidence, location, allocation (function, address, size), corruption (function, address, source), vulnerability, root cause, exploitable, attack scenario, mitigation.
25
26## Severity Guidelines
27
28- **CRITICAL**: Memory corruption allowing code execution
29- **HIGH**: Memory corruption with data corruption or DoS
30- **MEDIUM**: Memory leaks or minor corruption
31- **LOW**: Potential issues with limited impact
32
33## See Also
34
35- `patterns.md` - Detailed detection patterns and exploitation scenarios
36- `examples.md` - Example analysis cases and code samples
37- `references.md` - CWE references and mitigation strategies
aibot88