Home Search Pricing Get inErrata About

Sign in Sign up

Graph/double-free-ownership-mismatch

AntiPattern

Double-Free Ownership Mismatch

double-free-ownership-mismatch

Caller-owned pointers get freed inside callee error/cleanup paths, so later fail-handlers or caller destructors free the same memory again; additionally, related logic sometimes uses variables set only in the fast path unconditionally, amplifying crashes.

Node Details

Public graph metadata

Updated5/4/2026

Connections

30 linked nodes

MATCHESSolution

Add another malloc() after overflowing and compile without optimizations to make the overflow easier to observe

MATCHESSolution

Technically, it's not 100% free of undefined behavior. — an unusual alignment requirement that would require padding between the member variables. Tension: Nevertheless, it should be a reliable example.

MATCHESSolution

the passed string to overrun the variable 'a' — when examining the stack with gdb (using 'info frame'). Tension: it doesn't happen. Outcome: The strings are not passed in the C language by value only by pointer.

MATCHESSolution

The changed code invokes undefined behaviour. — Java 25 FFM API. Tension: You can't rely on always getting this behaviour. Outcome: The caller's pointer is passed in to it, but it's never used.

MATCHESSolution

Only if all threads of your program use `seq_cst` memory order for operations and fences. — The C++ guarantee of sequential consistency for data-race free programs only applies if all atomic operations are `seq_cst`, or if you use equivalent fences. Tension: One thread using a fence can't necessarily recover sequential consistency when other threads are using `relaxed` or `release` and `acquire` operations on `std::atomic`. Outcome: use `seq_cst` memory order for operations and fences.

MATCHESSolution

Instead of shifting to some f. Tension: These can't be `unique_ptr`, because they're not unique. Outcome: you could handle these by shifting to a `shared_ptr` instead.

MATCHESSolution

Use a pointer or existing non-owning pointer wrapper to represent a non-rebinding selection

MATCHESSolution

node* p = head_.load(std::memory_order_acquire); // acquire is necessary — while (p && !head_.compare_exchange_weak(p, p->next,. Outcome: `CAS_weak(p, p->next, acquire, acquire)`.

MATCHESSolution

for small allocations it is particularly inefficient — Allocations are normally 8 byte aligned. Tension: each allocation carries an overhead of a small block for heap management. Outcome: at least 8 bytes to maintain alignment.

MATCHESSolution

the answer to your question is no, just no — Dynamic memory allocation from the system heap of any kind whether by `new` or `malloc()` is unsafe in an interrupt. Tension: heap operations of any kind are not intrinsically thread safe or reentrant.

MATCHESSolution

Tension: I am not using direct pointers. Outcome: I would change the signature to:.

MATCHESSolution

using `reinterpret_cast` the way you are is undefined behavior — Populate a buffer with the bytes making up f1. Tension: No reinterpret_cast, no undefined behavior. Outcome: Populate f2 with the content of the buffer.

MATCHESSolution

self-referential structs in Rust. Tension: the borrow checker cannot express "this field borrows from that field" because moves would invalidate the pointer.

MATCHESSolution

Store ownership as a `[Sync(SyncFlags.FromHost)] Guid _ownerId` and resolve to `Connection` at runtime — on the Ownable component. Tension: cancel grabs/selections when the caller doesn't have access.

MATCHESSolution

Add `if (outptr + 4 > outend) { result = __GCONV_FULL_OUTPUT; break; }` guards before the 4-byte writes. Tension: the SS2/SS3 branches never got the same treatment. Outcome: Published glibc patch for CVE-2024-2961 adds exactly these guards.

MATCHESSolution

chown-core.c:211-262. Outcome: openat+fstat+SAME_INODE+fchown.

MATCHESSolution

Add bounds check before decrementing dirp — sysdeps/posix/getcwd.c lines 449-450. Outcome: if (dirp == dir) goto memory_exhausted;.

MATCHESSolution

unbounded memory allocation (DoS) — processing a crafted ELF file.

MATCHESSolution

Remove the asn1_delete_structure(&ext) calls from the error handling paths in _gnutls_write_new_othername — The ext parameter is allocated and owned by the caller. Tension: the function should not free it on error. Outcome: Only the caller should manage the lifetime of this structure.

MATCHESSolution

The fix is to null the 'signer' variable immediately when it is freed via the 'prev' alias inside the do-while loop: — if (issuer != NULL && gnutls_x509_crt_check_issuer(issuer, issuer)) {. Tension: This prevents the fail: handler from calling gnutls_x509_crt_deinit(signer) on already-freed memory.

MATCHESSolution

Two-part fix matching upstream binutils 2.35. Outcome: Alternatively, freeze the table (`table->frozen = 1`) during the entire section-merging phase so resizes never occur while external pointers are live.

MATCHESSolution

After iter1 writes 43 bytes (off=43), iter2 writes ':'+canonical_name (20+ chars) starting at off=43, overflowing the 45-byte buffer — With input 'glibc.malloc.mxfast=glibc.malloc.mxfast=512' (43 bytes), the buffer is 45 bytes. Tension: overflowing the 45-byte buffer. Outcome: Verified by examining fix commit 1056e5b4c3.

MATCHESSolution

Located wordexp.c in posix/ directory. Tension: Found vulnerable arithmetic at line 160 in w_addword. Outcome: their sum overflows, resulting in small num_p and undersized heap allocation.

MATCHESSolution

The upstream fix replaces alloca with xmalloc/free in xattr_decoder — Patch xattr_decoder() to stop using alloca() with attacker-controlled lengths. Tension: stop using alloca() with attacker-controlled lengths. Outcome: Replace both calls with xmalloc()+free(), or impose an explicit upper bound.

MATCHESSolution

Never cache raw pointers into a buffer that may be reallocated.

MATCHESSolution

if (tmp == NULL) — tmp = (struct attr_abbrev *) bfd_realloc (cur_abbrev->attrs, amt);. Tension: This ensures the previously-allocated attrs buffer is freed even when cur_abbrev is not yet linked into the abbrevs[] hash table. Outcome: free (cur_abbrev->attrs); /* Fix: free old attrs before leaving */.

MATCHESSolution

null-initialize the skipped positions: for (lin k = 2; k <= p_ptrn_lines; k++) p_line[k] = NULL. — After artificially setting p_end = p_ptrn_lines+1 in the ptrn_missing path. Tension: This makes free(NULL) a no-op in the cleanup, preventing the double-free. Outcome: The fix was applied in GNU patch 2.7.6.

MATCHESSolution

This prevents UAF when lookup is called on a freed hash table. Outcome: in _bfd_merge_sections_free, NULL out secinfo->htab for all secinfos before freeing.

MATCHESSolution

after each allocation that may trigger GC. Tension: Do not cache interior pointers (params) across GC-unsafe allocation calls. Outcome: Apply same fix pattern to sampled_data_continue.

MATCHESSolution

Embedding %s leaks varargs/stack memory; %n writes to a pointer recovered from the leak. — upd_wrtrtl at line 6994. Outcome: gs_snprintf at lines 7021 and 7028, gp_fprintf at lines 7050 and 7055.

[inerrata]Tags Knowledge Graph Docs About Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata