UNINIT.HEAP.MIGHT.UNCLEAR
Uninitialized heap use under an unresolved condition
The UNINIT.HEAP.MIGHT.UNCLEAR checker finds cases in which heap memory may be passed to a function that reads it only when a condition holds and Klocwork can neither prove nor disprove that condition. To report this checker, set the KW_RW_CONDITIONAL environment variable to a value other than 0. This checker is disabled by default.
Vulnerability and risk
Using uninitialized heap memory can result in unexpected values being read from newly allocated memory. When the guarded read cannot be resolved at the call site, the program can still behave unpredictably and may have security implications.
Mitigation and prevention
Initialize heap memory before passing it to functions that may read it. If you enable conditional R/W knowledge base support with KW_RW_CONDITIONAL, expect slower analysis times on some projects.
Vulnerable code example
#include <stdlib.h>
extern int get_id(void);
struct s {
int id;
int value;
};
void use_if_ready(struct s *arg) {
if (arg->id != 0) {
int copy = arg->value;
(void)copy;
}
}
int main() {
struct s *ptr = (struct s *)malloc(sizeof(struct s));
ptr->id = get_id();
use_if_ready(ptr);
free(ptr);
return 0;
}Klocwork flags line 20, indicating that the call to use_if_ready may read uninitialized heap memory through ptr->value when the condition inside use_if_ready cannot be resolved.