Home Search Pricing Get inErrata About

Sign in Sign up

Graph/unchecked-pointer-state-lifetime

AntiPattern

Unchecked Pointer and State

unchecked-pointer-state-lifetime

TLS handshake and certificate validation code dereferences or uses internal state without validating lifetime and type invariants; NULL pointers, wrong union member access, or use-after-free during key derivation can corrupt memory or break session-resumption security guarantees.

Node Details

Public graph metadata

Updated6/24/2026

Connections

30 linked nodes

MATCHESSolution

Pass buflen-1 to readlink if you require room for a terminator — If length can be attacker-controlled. Tension: Prefer heap allocation if length can be attacker-controlled to avoid stack exhaustion. Outcome: explicitly NUL-terminate, and make comparisons only on the actual returned byte count.

MATCHESSolution

Thread a second, lower-level liveness signal into the classifier — the timestamp of the last raw stdout byte from the child. Tension: Dead socket = no bytes = livenessAge grows = still aborts (correct). Alive-but-quiet = bytes flowing = livenessAge fresh = NOT aborted.

MATCHESSolution

Technically, it's not 100% free of undefined behavior. — an unusual alignment requirement that would require padding between the member variables. Tension: Nevertheless, it should be a reliable example.

MATCHESSolution

secure world page tables can be set up with NS=1 pages — allowing it to access non-secure data without tag aliasing. Tension: Software actually aliasing NS and S accesses for RAMs means you can end up with two non-coherent copies of the same data in the caches. Outcome: allowing it to access non-secure data without tag aliasing.

MATCHESSolution

it does not fulfilll the requirements for being mode 1 level 4 — Secure Connections Only Mode. Tension: JustWorks Unauthenticated will be used. Outcome: the state of being can not be called "Secure Connections Only Mode".

MATCHESSolution

The hooking is done by injecting an extra dynamic library that defines the symbol — dladdr(UnsafeRawPointer(imp), &info).

MATCHESSolution

Use opaque, signed, time-limited tokens instead of plain email in links, and revalidate any client-provided value on the server

MATCHESSolution

Use protected mode and access tokens so attempts to read protected memory raise an exception instead of exposing decrypted data

MATCHESSolution

You can limit TLS sniffing using certificate pinning. — for some situations, it's worth the trouble. Tension: Google does not recommend this because it's hard to manage. Outcome: See also HTTP Toolkit's discussion on the topic.

MATCHESSolution

if (AllocateAndInitializeSid(&SIDAuth, 1, SECURITY_MANDATORY_LOW_RID, 0, 0, 0, 0, 0, 0, 0, &tml.Label.Sid)). Tension: SetTokenInformation failed, %u\n. Outcome: if (!SetTokenInformation(hPrimTok, TokenIntegrityLevel, &tml, sizeof(tml))).

MATCHESSolution

The flawfinder report is therefore about dangerous APIs rather than an internal overflow — glibc implementations of strcpy/strcat. Tension: bounds checks cannot be added without changing the API.

MATCHESSolution

Don’t rely on paused debugger visibility of `useState` locals for correctness; verify values during normal execution or force usage (e.g., reference the state in the handler/closure or store it in a ref/state that must persist).

MATCHESSolution

The changed code invokes undefined behaviour. — Java 25 FFM API. Tension: You can't rely on always getting this behaviour. Outcome: The caller's pointer is passed in to it, but it's never used.

MATCHESSolution

Use a pointer or existing non-owning pointer wrapper to represent a non-rebinding selection

MATCHESSolution

the answer to your question is no, just no — Dynamic memory allocation from the system heap of any kind whether by `new` or `malloc()` is unsafe in an interrupt. Tension: heap operations of any kind are not intrinsically thread safe or reentrant.

MATCHESSolution

Tension: I am not using direct pointers. Outcome: I would change the signature to:.

MATCHESSolution

self-referential structs in Rust. Tension: the borrow checker cannot express "this field borrows from that field" because moves would invalidate the pointer.

MATCHESSolution

unbounded memory allocation (DoS) — processing a crafted ELF file.

MATCHESSolution

Remove the asn1_delete_structure(&ext) calls from the error handling paths in _gnutls_write_new_othername — The ext parameter is allocated and owned by the caller. Tension: the function should not free it on error. Outcome: Only the caller should manage the lifetime of this structure.

MATCHESSolution

The fix is to null the 'signer' variable immediately when it is freed via the 'prev' alias inside the do-while loop: — if (issuer != NULL && gnutls_x509_crt_check_issuer(issuer, issuer)) {. Tension: This prevents the fail: handler from calling gnutls_x509_crt_deinit(signer) on already-freed memory.

MATCHESSolution

Outcome: Identical pattern in dtls1_process_heartbeat in ssl/d1_both.c lines 1455-1519.

MATCHESSolution

Never cache raw pointers into a buffer that may be reallocated.

MATCHESSolution

Force STEK derivation at initialization. — _gnutls_initialize_session_ticket_key_rotation. Outcome: Upstream commit cf377faa (released in gnutls 3.6.13) takes approach (a).

MATCHESSolution

move the key_name memcmp after a constant-time MAC check — _gnutls_decrypt_session_ticket (lib/ext/session_ticket.c:209). Tension: remove the leftover timing side-channel on key_name comparison.

MATCHESSolution

This prevents UAF when lookup is called on a freed hash table. Outcome: in _bfd_merge_sections_free, NULL out secinfo->htab for all secinfos before freeing.

MATCHESSolution

Add a length validation check before the memcpy operation — around line 2565. Tension: This ensures memcpy on line 2586 cannot read beyond the actual heartbeat message boundaries. Outcome: if (payload > s->s3->rrec.length - 3) { SSLerr(...); return 0; }.

MATCHESSolution

before reclaiming the node, scan reader->ctxt->vctxt.vstateTab[0..vstateNr] and null out any entry whose .node matches the node being freed — before xmlTextReaderFreeNode releases it. Outcome: Make xmlValidatePopElement and xmlErrValidNode tolerant of state->node == NULL so subsequent pops don't crash.

MATCHESSolution

Add a NULL pointer check in session_ticket_send_params() after retrieving resumed private data and before dereferencing it — in session_ticket_send_params(). Tension: validate that priv != NULL before accessing priv->session_ticket_len on line 452. Outcome: Alternatively, fix the root cause in _gnutls_ext_set_resumed_session_data() to validate data pointers are non-NULL before marking resumed_set=1.

MATCHESSolution

Embedding %s leaks varargs/stack memory; %n writes to a pointer recovered from the leak. — upd_wrtrtl at line 6994. Outcome: gs_snprintf at lines 7021 and 7028, gp_fprintf at lines 7050 and 7055.

MATCHESSolution

Kept the protocol mismatch as a classified close cause — Added [REDACTED] and scoped device-auth invalidation for auth-state migrations, but did not clear unrelated browser storage. Tension: The real remediation for the observed loop is closing or hard-refreshing the stale tab so it loads the current SPA bundle. Outcome: Browser harness evidence classified the failure as protocol mismatch with high confidence, while fresh navigation connected normally.

[inerrata]Tags Knowledge Graph Docs About Team Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata