Memory Errors¶

#include <stdlib.h>
// this is in the data section
const char *HELLO = "hello";
// this is in the BSS section
long counter;
void main() {
    // this is in the stack memory
    int val;
    // the msg pointer is in the stack memory
    // the msg content is in the heap memory
    char *msg = malloc(120);
    // msg content is explicitly freed here
    free(msg);
    // the val and msg pointer is implicitly freed here
}
// the global memory is only destroyed on program exit

long foo(long a, long b, long c, long d, long e, long f, long g, long h) {
    long xx = a * b * c;
    long yy = d + e + f;
    long zz = g - h;
    return xx + yy + zz;
}

typedef struct Response {
    int status;
    char message[40];
} response_t;
void process(){
    response_t *res = malloc(sizeof(response_t));// allocate memory on the heap
    struct Response res2;// allocate memory on the stack
}

int foo(int x) {
    int arr[16]={0};
    return arr[x];//x is not checked
}

long foo(){
    int a = 0;
    return *(long*)(&a);//a is not long
}

int foo(int *p){
   // if p == NULL, then dereference p will cause a segmentation fault
    return *p + 42;
}

int foo(){
    int *p = malloc(sizeof(int));
    *p = 42;
    free(p);
    return *p;//p is freed
}

int foo(){
    int p;
    return p;//这个p是在栈上分配的，可能为残留值
}

int foo() {
    int *p = malloc(sizeof(int));
    return *p;//这个p是在堆上分配的，可能为任意值
}

int foo() {
    int *p = malloc(sizeof(int));
    int *q = malloc(sizeof(int));
    *p = 42;
    free(q);
    return *p;//p is not freed
}

int dtls1_process_heartbeat(SSL *s) {
    unsigned char *p = &s->s3->rrec.data[0], *pl;
    unsigned short hbtype;
    unsigned int payload;
    unsigned int padding = 16; /* Use minimum padding */
    /* Read type and payload length first */
    hbtype = *p++;
    n2s(p, payload);
    pl = p;
    if (s->msg_callback) s->msg_callback(0, s->version, TLS1_RT_HEARTBEAT, &s->s3->rrec.data[0], s->s3->rrec.length, s, s->msg_callback_arg);
    if (hbtype == TLS1_HB_REQUEST) {
        unsigned char *buffer, *bp;
        int r;
        /* Allocate memory for the response, size is 1 bytes
        * message type, plus 2 bytes payload length, plus
        * payload, plus padding
        */
        buffer = OPENSSL_malloc(1 + 2 + payload + padding);
        bp = buffer;
        /* Enter response type, length and copy payload */
        *bp++ = TLS1_HB_RESPONSE;
        s2n(payload, bp);
        memcpy(bp, pl, payload);
        bp += payload;
        /* Random padding */
        RAND_pseudo_bytes(bp, padding);
        r = dtls1_write_bytes(s, TLS1_RT_HEARTBEAT, buffer, 3 + payload + padding);
        if (r >= 0 && s->msg_callback) s->msg_callback(1, s->version, TLS1_RT_HEARTBEAT, buffer, 3 + payload + padding, s, s->msg_callback_arg);
        OPENSSL_free(buffer);
    }
    return 0;
}