LOCRET.ARG

Function returns address of local variable

The LOCRET.ARG checker finds instances in which a function returns the address of a local variable by writing it into memory referenced by its argument.

Vulnerability and risk

Local variables are allocated on the stack, so when a function returns a pointer to the variable, it's returning a stack address. The address will be invalidated after returning from the function, so access will probably cause unexpected application behavior, typically a program crash.

Vulnerable code example

1
2
3
4
5
6
7
8
9
10
11
  #include <stdlib.h>
  
  void func_ARG(int **pp, unsigned n)
  {
      int aux;
      if (n == 1) {
          *pp = &aux;
      } else {
          *pp = (int *)malloc(n * sizeof(int));
     }
 }

Klocwork flags line 7, indicating that function func_ARG returns the address of a local variable through its argument. The address of local variable aux can be assigned to *pp, which can be used when the function returns.

Related checkers

• LOCRET.GLOB
• LOCRET.RET

External guidance

• CERT DCL30-C: Declare objects with appropriate storage durations
• CERT EXP54-CPP: Do not access an object outside of its lifetime
• CWE-416: Use After Free
• CWE-562: Return of Stack Variable Address
• CWE-672: Operation on a Resource after Expiration or Release

Security training

Application security training materials provided by Secure Code Warrior.

• Use After Free Training Video - Test your skills with a training example