CS.UFR

Using freed resource

Because C# has a garbage collector, it is largely protected from many memory issues. However, objects using unmanaged resources (for example., 'IDisposable' objects) can still be prone to use-after-free bugs. The CS.UFR checker flags the use of disposed resources.

Vulnerability and risk

Accessing an 'IDisposable' object after it has been disposed will result in an exception being thrown, which could cause the program to terminate prematurely if it is not handled.

Vulnerable code example

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
   using System.IO;
    
   namespace Example
   {
       class Program
       {
           static void Main(string[] args)
           {
               BinaryWriter bw = new BinaryWriter(new FileStream("aaa.txt", FileMode.Open)); // Or, any other IDisposable
              bw.Dispose();
   
              bw.Write("bbb"); //@ CS.UFR. We are accessing the resource after it has been disposed of.
          }
   
      }
  }

In this example, Klocwork reports a CS.UFR defect at line 12, when the code accesses the resource after it has been disposed of.

Fixed code example

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
   using System.IO;
    
   namespace Example
   {
       class Program
       {
           static void Main(string[] args)
           {
               BinaryWriter bw = new BinaryWriter(new FileStream("aaa.txt", FileMode.Open)); // Or, any other IDisposable
              bw.Write("bbb"); //@no CS.UFR.
              bw.Dispose();
          }
   
      }
  }

External guidance

• CWE-416: Use After Free

Security training

Application security training materials provided by Secure Code Warrior.

• Use After Free Training Video - Test your skills with a training example