Unchecked Return Value of Malloc Detection
Detection Workflow
- Identify allocation operations: Find all malloc() calls, locate calloc() calls, identify realloc() calls, map new/delete operations
- Trace return values: Follow allocation result, identify first dereference, check for NULL validation, assess error handling
- Check error handling: Verify NULL checks exist, assess error handling completeness, review fallback behavior, check for graceful degradation
- Assess impact: Can allocation fail? What happens on failure? Is crash possible? What's the security impact?
Key Patterns
- Unchecked malloc: malloc() return value not checked, direct use of malloc() result, no NULL check before dereference, assumption malloc never fails
- Unchecked calloc: calloc() return value not checked, direct use of calloc() result, no NULL check before dereference, assumption calloc never fails
- Unchecked realloc: realloc() return value not checked, direct assignment to original pointer, no NULL check before dereference, losing original pointer on failure
- Unchecked new (C++): new return value not checked, assuming new never throws, no exception handling, missing std::nothrow usage
Output Format
Report with: id, type, subtype, severity, confidence, location, vulnerability, allocation_call, allocation_type, allocation_size, null_check, first_dereference, exploitable, attack_scenario, impact, mitigation.
Severity Guidelines
- HIGH: Unchecked allocation in critical code
- MEDIUM: Unchecked allocation causing crashes
- LOW: Unchecked allocation with limited impact
See Also
patterns.md - Detailed detection patterns and exploitation scenariosexamples.md - Example analysis cases and code samplesreferences.md - CWE references and mitigation strategies
1---2name: detecting-unchecked-malloc3description: Detects unchecked return values of memory allocation functions like malloc, calloc, and realloc that can lead to null pointer dereferences. Use when analyzing memory allocation, error handling, or investigating null pointer risks.4---5
6# Unchecked Return Value of Malloc Detection
7
8## Detection Workflow
9
101. **Identify allocation operations**: Find all malloc() calls, locate calloc() calls, identify realloc() calls, map new/delete operations
112. **Trace return values**: Follow allocation result, identify first dereference, check for NULL validation, assess error handling
123. **Check error handling**: Verify NULL checks exist, assess error handling completeness, review fallback behavior, check for graceful degradation
134. **Assess impact**: Can allocation fail? What happens on failure? Is crash possible? What's the security impact?
14
15## Key Patterns
16
17- Unchecked malloc: malloc() return value not checked, direct use of malloc() result, no NULL check before dereference, assumption malloc never fails
18- Unchecked calloc: calloc() return value not checked, direct use of calloc() result, no NULL check before dereference, assumption calloc never fails
19- Unchecked realloc: realloc() return value not checked, direct assignment to original pointer, no NULL check before dereference, losing original pointer on failure
20- Unchecked new (C++): new return value not checked, assuming new never throws, no exception handling, missing std::nothrow usage
21
22## Output Format
23
24Report with: id, type, subtype, severity, confidence, location, vulnerability, allocation_call, allocation_type, allocation_size, null_check, first_dereference, exploitable, attack_scenario, impact, mitigation.
25
26## Severity Guidelines
27
28- **HIGH**: Unchecked allocation in critical code
29- **MEDIUM**: Unchecked allocation causing crashes
30- **LOW**: Unchecked allocation with limited impact
31
32## See Also
33
34- `patterns.md` - Detailed detection patterns and exploitation scenarios
35- `examples.md` - Example analysis cases and code samples
36- `references.md` - CWE references and mitigation strategies
majiayu000