Home Search Pricing Get inErrata About

Sign in Sign up

Graph/null-or-use-after-free-dereference

Pattern

NULL/Freed Pointer Dereference

null-or-use-after-free-dereference

Dereferenced pointers or freed buffers get reused without a validating guard—e.g., resumed_priv NULL is assigned without checks, or ECDH ephemeral params are freed then accessed by cleanup—causing crashes or memory corruption during handshake/extension processing.

Node Details

Public graph metadata

Updated6/27/2026

Connections

30 linked nodes

In tar's bundled gnulib wordsplit implementation. Tension: the buffer pointer arithmetic uses namelen++ before the copy, creating an off-by-one hazard if namelen/value length relationships ever desynchronize. Outcome: This is flagged by flawfinder as [REDACTED].

Java FFM upcall pointer parameters are linked with a confined memory session on Windows when the callback also takes a larger-than-pointer struct

This happens only when in create a "Release" build, not for "Debug " builds. — when heap-allocating (`new bool`, `make_unique`, ...) but not when stack-allocating in the same location. Tension: I was not able to reduce the code the code any further. Outcome: The code exhibits undefined behavior.

sometimes it fails at new/malloc/delete/free — in usb_otg_fs(interrupt) i read data and dynamically allocate 8 bytes. Tension: the problem is sometimes it fails at new/malloc/delete/free.

Dynamic memory allocation is ill-advised in any event in most small scale and real-time embedded applications — in most small scale and real-time embedded applications. Tension: non-deterministic timing, the need to deal with the potential for failure and memory exhaustion. Outcome: particularly ill-advised in (and generally prohibited) safety critical systems.

self-referential structs in Rust. Tension: the borrow checker cannot express "this field borrows from that field" because moves would invalidate the pointer.

one-byte heap buffer over-read (CVE-2022-48303) in its base-256 (binary) numeric field decoder — GNU tar 1.34 (src/list.c, function `from_header`). Outcome: unbounded heap over-reads until an overflow check or segfault.

A heap buffer overflow vulnerability exists in binutils BFD library when processing compressed ELF sections — when decompressing a section marked with SHF_COMPRESSED flag. Outcome: causing the decompression function to read far beyond the allocated buffer boundary.

A use-after-free vulnerability exists in libxml2 v2.11.5 XML reader — when both DTD validation and XInclude expansion are enabled.

memory leak in binutils display_debug_abbrev — readelf/objdump --debug-dump=abbrev. Outcome: an attacker can drive unbounded heap growth and DoS the tool.

strcpy with unchecked length on stack buffer in sunrpc/clnt_gen.c:62 — When the protocol is 'unix', the function copies a user-controlled hostname parameter directly into a 108-byte fixed-size buffer (sun_path). Tension: Hostnames longer than 108 bytes cause the strcpy() to overflow the buffer and corrupt adjacent stack memory, potentially allowing code execution.

suffers an unbounded memory allocation (DoS) — when processing a crafted ELF file.

GnuTLS contains a double-free vulnerability (CVE-2022-2509) in the _gnutls_write_new_othername function — when exporting otherName subject alternative names (SAN) extensions in X.509 certificates. Tension: When ASN.1 encoding operations fail, the function incorrectly frees the caller-allocated ASN1_TYPE structure. Outcome: leading to a double-free when the caller's cleanup code attempts to free the same structure again.

allows an attacker to read out-of-bounds memory or cause denial of service — OpenSSL's X.509 certificate name checking code. Tension: The vulnerability exists in the do_x509_check() function where union members of GENERAL_NAME are accessed based on the check_type parameter rather than the actual gen->type field. Outcome: leading to out-of-bounds memory reads.

The PoC writes 0x2F into a canary byte placed immediately before a 1-byte buffer — when the current working directory is the filesystem root and the caller passes a buffer of size 1. Tension: This corrupts adjacent memory (heap metadata or stack data). Outcome: Vulnerability disappears once the size<2 guard is added.

heap use-after-free in two TLS 1.3 client extension serializers — lib/ext/key_share.c:key_share_send_params and lib/ext/pre_shared_key.c:client_send_params. Outcome: Subsequent reads/writes through the cached alias are use-after-free.

heap buffer overflow vulnerability in curl's SOCKS5 proxy handshake when processing hostnames — when processing hostnames. Tension: the hostname length is truncated to a single byte via an unsafe cast, but the full hostname is still copied into the buffer. Outcome: causing heap memory corruption.

heap buffer overflow vulnerability in the match_regex function. Tension: When a regex pattern contains backreferences. Outcome: heap buffer overflow vulnerability in the match_regex function.

Tension: libcurl continued to invoke the prior PUT read-callback path on the reused connection, dereferencing memory the application had already freed.

bfd_realloc() fails while growing the attribute array (cur_abbrev->attrs) — In bfd/dwarf2.c, the function read_abbrevs(). Tension: for a DWARF abbreviation entry that has NOT yet been linked into the abbrevs[] hash table. Outcome: leaks heap memory.

GNU patch v2.7.5 has a double-free vulnerability in the `another_hunk()` function in `src/pch.c`.

bfd_hash_lookup() on the freed table reads freed memory at table->table[_index]. Tension: sec_merge_sec_info structs in elf_section_data still hold a dangling secinfo->htab pointer. Outcome: Can reach abort() via reachable assertions at lines 929/933/935 in merge.c.

Ghostscript 9.50 (psi/zfsample.c) has a use-after-free in sampled_data_finish — compacting/moving GC. Tension: Two C local variables cache raw pointers into GC-managed objects.

At line 688 in merge_strings(), accessing secinfo->sec->size results in potential use-after-free — BFD (Binary File Descriptor library) contains a use-after-free vulnerability in its SEC_MERGE section handling code.

stack buffer overflow vulnerability in OpenSSL 3.0.0-3.0.6 — when processing X.509 certificates with name constraints containing punycode-encoded email address domain names. Tension: allows writing past the end of a 512-element stack-allocated buffer. Outcome: The vulnerability is triggered when a certificate's name constraint contains a punycode domain label that decodes to 512+ Unicode codepoints.

GnuTLS 3.6.14 crashes with a NULL pointer dereference — when processing a crafted TLS ClientHello with a session_ticket extension during session resumption. Tension: An attacker can trigger this by sending a malformed ClientHello during session resumption, causing server denial of service. Outcome: The vulnerability exists in GnuTLS 3.6.14 and is triggered during TLS session resumption when a ClientHello contains a malformed session_ticket extension with NULL or empty data.

fails to validate namelen before dereferencing name[0] — when processing XML with empty QNames. Tension: causing uninitialized memory reads and inconsistent hashing that leads to double-free vulnerabilities. Outcome: Fix in commit 547edbf1cbdc.

readelf crashes with an out-of-bounds read — processing malformed DWARF debug information in .debug_str_offsets sections. Tension: The vulnerability occurs in the fetch_indexed_string function when a crafted .debug_str section with a non-zero address field is combined with string offset values. Outcome: The out-of-bounds read occurs when strnlen() is called with an underflowed length value.

resulting in a write to freed heap memory via memset() — during the TLS handshake. Tension: If key derivation fails during client key exchange processing, the ephemeral parameters are freed by calc_ecdh_key() but then accessed again by the caller's cleanup code. Outcome: The vulnerability is fixed by eliminating the double-cleanup anti-pattern.

wget: potential over-read via strlen on xattr value pointer

[inerrata]Tags Knowledge Graph Docs About Team Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata

NULL/Freed Pointer Dereference - inErrata Knowledge Graph | Inerrata