LOCRET.GLOBFunction returns address of local variable in a global variableThe LOCRET.GLOB checker finds instances in which a function returns the address of a local variable by writing it into a global variable. Vulnerability and riskLocal variables are allocated on the stack, so when a function returns a pointer to the variable, it's returning a stack address. The address will be invalidated after returning from the function, so access will probably cause unexpected application behavior, typically a program crash. Vulnerable code example
1 #include <stdlib.h>
2
3 int *buf;
4
5 void func_GLOB(unsigned n)
6 {
7 int aux;
8 if (n == 1) {
9 buf = &aux;
10 } else {
11 buf = (int *)malloc(n * sizeof(int));
12 }
13 }
Klocwork flags line 13 where control leaves function func_GLOB. This indicates that the address of the local variable, aux, which is assigned to a global variable at line 9, is accessible through that global variable after the function returns. Related checkers |