9.11 Memory regions: Heap/Stack

...

What four regions does a program's memory usage typically include and what does each one store?
Four regions that a program's memory usage typically includes and what each one stores are:

  1. Code - The program's instructions.
  2. Static memory - Global and static variables.
  3. The stack (automatic memory) - Local variables during a function call.
  4. The heap (free store) - Dynamically allocated memory using functions like malloc.
Example of a C program which uses all four regions of memory
#include <stdio.h>
#include <stdlib.h>

// Program is stored in code memory

int myGlobal = 33;    // In static memory

void MyFct() {
	int myLocal;      // On stack  
	myLocal = 999;
	printf(" %d", myLocal);
}

int main(void) {
	int myInt;            // On stack
	int* myPtr = NULL;    // On stack
	myInt = 555; 

	myPtr = (int *)malloc(sizeof(int)); // In heap
	*myPtr = 222;
	printf("%d %d", *myPtr, myInt);
	free(myPtr);  // Deallocated from heap

	MyFct();  // Stack grows, then shrinks

	return 0;
}
Address Code Memory
0001 Add R1, #1, R2
0002 Sub R3, #1, R4
0003 Add R1, R3, R5
0004 Jmp 40
Address Static memory Variable Name
3000 33 myGlobal
3001
Address Stack Variable Name and Calling Function
3200 555 myInt, main()
3201 9400 myPtr, main()
3202 999 myLocal, MyFct()
3203
Address Heap Variable Name and Function
9400 222
9401
9402

9.12 Memory leaks

When does a memory leak occur?
A memory leak occurs when a program which allocates memory loses the ability to access the allocated memory.

What typically causes memory leaks to occur?
Memory leaks are typically caused by a failure to properly destroy or free dynamically allocated memory.

What can a memory leak cause a program to do?
A memory leak can cause a program to occupy more and more memory as it runs.

What are two potential consequences of a program which occupies more and more memory as it runs?
Two potential consequences of a program which occupies more and more memory as it runs are:

  1. Slow program runtime.
  2. Failure if more memory can't be allocated.

What is garbage collection?
Garbage collection is an automatic feature in a program's executable which finds all unreachable allocated memory locations and frees them.

How does garbage collection find all unreachable memory locations?
Garbage collection finds all unreachable memory locations by comparing all reachable memory with all previously-allocated memory.

...

9.14 Secure Programming: NULL Pointers

What happens when you dereference a null pointer?
Dereferencing a null pointer causes undefined behavior.

What happens on many platforms when a null pointer is dereferenced?
When a null pointer is dereferenced on many platforms, it causes abnormal program termination.

Is abnormal program termination required by the C standard when a null pointer is dereferenced?
No, abnormal program termination isn't required by the C standard when a null pointer is dereferenced.

What is the C secure coding standard which says to not dereference null pointers? (1)
The C secure coding standard which says to not dereference null pointers is EXP34-C.

...

9.15 Secure Programming: Use-after-free Errors

What happens when you evaluate a pointer that points to memory which has been deallocated by a memory management function?
Evaluating a pointer that points to a memory which has been deallocated by a memory management function causes undefined behavior.

During what operations is a pointer evaluated?
Operations where a pointer is evaluated include:

  • Dereferencing it.
  • Using it as an operand of an arithmetic operation.
  • Type casting it.
  • Using it as the right-hand side of an assignment.

What are pointers which point to deallocated memory called?
Pointers which point to deallocated memory are called dangling pointers.

What happens when you access a dangling pointer?
When you access a dangling pointer, exploitable vulnerabilities can happen.

Why is reading a dangling pointer cause undefined behavior?
Reading a dangling pointer causes undefined behavior because the pointer value is intermediate and might be a trap representation.

What is a trap representation? (1)
Trap representation is an object representation that doesn't represent a value of the object type.

What is at the memory manager's discretion?
It is at the memory manager's discretion when to reallocate or recycle the freed memory.

What are the two things which can happen to memory the moment it is freed?
The two things which can happen to memory the moment it is freed are:

  1. It is returned to the operating system.
  2. It remains intact and accessible until it is overwritten.

What is the C secure coding standard which says to not access freed memory? (1)
The C secure coding standard which says to not access freed memory is MEM30-C.

...