Allocation Vulnerabilities: Hidden Dangers in Memory Management

Pointers are one of the most powerful features in programming languages such as C. A pointer in C is a variable that holds or contains the address of another variable. However, incorrect use of pointers can result in data corruption, security vulnerabilities, and unpredictable behavior.

Dangling Pointers

A dangling pointer is a pointer that used to point to a valid memory location, but the memory has either been freed or reallocated elsewhere. The pointer still holds the old address, even though it no longer points to valid memory.

Let’s examine a common scenario:

char *data = malloc(10);    // allocate memory
char *ptr = data;           // ptr and data point to the same memory
// …
data = realloc(data, 1000); // realloc might move memory

printf("%s\n", ptr);        // ptr still points to old memory

As you can see, realloc() might move the data to a new location, but ptr still points to the old location of the data. If you try to use ptr after this, you are in dangerous territory because it points to stale memory which is a situation known as use-after-free. This could lead to memory corruption, crashes, or even security vulnerabilities if attackers can manipulate the behavior.

Use-After-Free (UAF) Vulnerability

A use-after-free occurs when a program accesses memory after it has been freed. This usually happens through a dangling pointer, which still points to the freed memory.

Here’s a simple example of a UAF vulnerability:

int *ptr = (int *)malloc(sizeof(int)); // allocate memory
*ptr = 10;

free(ptr); // memory is released

printf("%d", *ptr); // UAF: using memory after free

In this case, memory is allocated and assigned a value, and then it’s freed. But we still try to use the pointer afterward. That’s a use-after-free.

Consequences

• Crash or Unpredictable Behavior: The program might crash, or worse, appear to run fine while doing the wrong thing.
• Security Exploits: Freed memory might be deliberately manipulated and then accessed through the dangling pointer. Attackers can exploit UAF bugs to inject malicious code, escalate privileges, or control program flow.

How to Prevent UAF Vulnerabilities

• Set pointers to NULL after freeing them. Accessing a NULL pointer usually causes a crash, which is easier to detect and debug than accessing stale memory.

int *ptr = malloc(sizeof(int));
free(ptr);
ptr = NULL;  // Prevent use-after-free

• Never use a pointer once it has been freed. If the memory is needed again, allocate new memory using malloc().

free(ptr);
// Do NOT use *ptr after this!

• If multiple pointers reference the same block of memory, ensure all are properly handled when freeing.

char *data = malloc(10);
char *a = data;
char *b = a;
free(data);
data = NULL;
a = NULL;
b = NULL; // Prevent b from becoming a dangling pointer

Conclusion

Allocation vulnerabilities are common in low-level programming languages like C. They occur when a program accesses memory that has already been freed, which can lead to crashes, unpredictable behavior, or serious security vulnerabilities. By managing memory carefully, setting pointers to NULL after freeing them, and using debugging tools, developers can avoid these dangerous bugs and write safer code.