Invalid free | XEIZE Docs

Description

Passing memory that was not dynamically allocated, a stack variable, or the address of a local object whose lifetime has ended to free, delete, or a kernel pool release function can cause invalid memory deallocation.

Potential impact

Process crashes or kernel panics can cause denial of service.
Corrupted heap metadata can lead to unpredictable behavior or security vulnerabilities.

Remediation

Use free for memory allocated by the malloc, calloc, or realloc family.
Use delete only for objects allocated with new.
Do not pass addresses of stack or global variables to deallocation functions.

Examples

Before

void run(void) {
    int value = 0;
    int *p = &value;
    free(p);
}

After

void run(void) {
    int *p = malloc(sizeof(int));
    if (p == NULL) {
        return;
    }
    free(p);
}

Explanation:

Before: p points to the stack variable value, so free(p) is invalid.
After: p points to heap memory allocated with malloc and is released with the matching free function.

References

CWE-590