CWE-762 Detail

The product attempts to return a memory resource to the system, but it calls a release function that is not compatible with the function that was originally used to allocate that resource.

Modes Of Introduction

Implementation

Applicable Platforms

Language

Class: Memory-Unsafe (Often)
Name: C (Undetermined)
Name: C++ (Undetermined)

Common Consequences

Potential Mitigations

Phases : Implementation
Only call matching memory management functions. Do not mix and match routines. For example, when you allocate a buffer with malloc(), dispose of the original pointer with free().
Phases : Implementation
Phases : Architecture and Design
Phases : Architecture and Design
Use a language that provides abstractions for memory allocation and deallocation.

Detection Methods

Dynamic Analysis with Automated Results Interpretation

Use a tool that dynamically detects memory management problems, such as valgrind.

Automated Dynamic Analysis

Use tools that are integrated during compilation to insert runtime error-checking mechanisms related to memory safety errors, such as AddressSanitizer (ASan) for C/C++ [REF-1518].
Effectiveness : Moderate

Vulnerability Mapping Notes

Justification : This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Comment : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Notes

References

REF-657

boost C++ Library Smart Pointers
https://www.boost.org/doc/libs/1_38_0/libs/smart_ptr/smart_ptr.htm

REF-480

Valgrind
https://valgrind.org/

REF-391

Transitioning to ARC Release Notes
iOS Developer Library.
https://developer.apple.com/library/archive/releasenotes/ObjectiveC/RN-TransitioningToARC/Introduction/Introduction.html

REF-1518

AddressSanitizer
https://clang.llvm.org/docs/AddressSanitizer.html

Submission

Modifications