BSTR.FUNC.FREE

Incorrect call to BSTR freeing function

The BSTR.FUNC.ALLOC checker finds calls to BSTR freeing function SysFreeString used incorrectly. The only argument of this function should be of type BSTR.

Vulnerability and risk

Because the two styles are constructed differently, converting COM-style BSTR strings to and from C-style strings needs care. In some cases, conversions between the two compile well, but still produce unexpected results.

Using BSTR freeing strings with non-BSTR arguments can cause problems with memory usage.

Mitigation and prevention

Unlike C-style strings, BSTR strings have a 4-byte length prefix that contains the number of bytes in the following data string. BSTR strings can also contain embedded null characters, and aren't strongly typed. For these reasons, it's best not to use BSTR in new designs. For existing interfaces, it's important to make conversions and use the Sys*Alloc*, SysFree* and Sys*String* memory allocation functions carefully.

Vulnerable code example

1  void bstr_free(wchar_t *s){
2    SysFreeString(s);
3  }

Klocwork flags line 2 because function SysFreeString, which expects the structure of a BSTR variable, is used on a wchar variable. This kind of usage can cause memory allocation issues.

Related checkers

• BSTR.FUNC.ALLOC
• BSTR.FUNC.LEN
• BSTR.FUNC.REALLOC