Dangling pointer · Lablypedia

Dangling pointers arise during object destruction, when an object that is pointed to by a given pointer is deleted or deallocated, without modifying the value of that said pointer, so that the pointer still points to the memory location of the deallocated memory. The system may reallocate the previously freed memory, and if the program then dereferences the (now) dangling pointer, unpredictable behavior may result, as the memory may now contain completely different data. If the program writes to memory referenced by a dangling pointer, a silent corruption of unrelated data may result, leading to subtle bugs that can be extremely difficult to find. If the memory has been reallocated to another process, then attempting to dereference the dangling pointer can cause segmentation faults (UNIX, Linux) or general protection faults (Windows). If the program has sufficient privileges to allow it to overwrite the bookkeeping data used by the kernel's memory allocator, the corruption can cause system instabilities. In object-oriented languages with garbage collection, dangling references are prevented by only destroying objects that are unreachable, meaning they do not have any incoming pointers; this is ensured either by tracing or reference counting. However, a finalizer may create new references to an object, requiring object resurrection to prevent a dangling reference.

Wild pointers, also called uninitialized pointers, arise when a pointer is used prior to initialization to some known state, which is possible in some programming languages. They show the same erratic behavior as dangling pointers, though they are less likely to stay undetected because many compilers will raise a warning at compile time if declared variables are accessed before being initialized.

Cause of dangling pointers

In many languages (e.g., the C programming language) deleting an object from memory explicitly or by destroying the stack frame on return does not alter associated pointers. The pointer still points to the same location in memory even though that location may now be used for other purposes.

A straightforward example is shown below:

<span id="mwKg"></span><span class="p" id="mwKw">{</span> <span class="w" id="mwLA"> </span><span class="kt" id="mwLQ">char</span><span class="o" id="mwLg">*</span><span class="w" id="mwLw"> </span><span class="n" id="mwMA">dp</span><span class="w" id="mwMQ"> </span><span class="o" id="mwMg">=</span><span class="w" id="mwMw"> </span><span class="nb" id="mwNA">NULL</span><span class="p" id="mwNQ">;</span> <span class="w" id="mwNg"> </span><span class="c1" id="mwNw">// ...</span> <span class="w" id="mwOA"> </span><span class="p" id="mwOQ">{</span> <span class="w" id="mwOg"> </span><span class="kt" id="mwOw">char</span><span class="w" id="mwPA"> </span><span class="n" id="mwPQ">c</span><span class="p" id="mwPg">;</span> <span class="w" id="mwPw"> </span><span class="n" id="mwQA">dp</span><span class="w" id="mwQQ"> </span><span class="o" id="mwQg">=</span><span class="w" id="mwQw"> </span><span class="o" id="mwRA">&</span><span class="n" id="mwRQ">c</span><span class="p" id="mwRg">;</span> <span class="w" id="mwRw"> </span><span class="p" id="mwSA">}</span><span class="w" id="mwSQ"> </span> <span class="w" id="mwSg"> </span><span class="c1" id="mwSw">// c falls out of scope</span> <span class="w" id="mwTA"> </span><span class="c1" id="mwTQ">// dp is now a dangling pointer</span> <span class="p" id="mwTg">}</span>

If the operating system is able to detect run-time references to null pointers, a solution to the above is to assign 0 (null) to dp immediately before the inner block is exited. Another solution would be to somehow guarantee dp is not used again without further initialization.

Another frequent source of dangling pointers is a jumbled combination of malloc() and free() library calls: a pointer becomes dangling when the block of memory it points to is freed. As with the previous example one way to avoid this is to make sure to reset the pointer to null after freeing its reference—as demonstrated below.

<span id="mwVg"></span><span class="cp" id="mwVw">#include</span><span class="w" id="mwWA"> </span><span class="cpf" id="mwWQ"><stdlib.h></span> <span class="kt" id="mwWg">void</span><span class="w" id="mwWw"> </span><span class="nf" id="mwXA">func</span><span class="p" id="mwXQ">()</span><span class="w" id="mwXg"> </span><span class="p" id="mwXw">{</span> <span class="w" id="mwYA"> </span><span class="kt" id="mwYQ">char</span><span class="o" id="mwYg">*</span><span class="w" id="mwYw"> </span><span class="n" id="mwZA">dp</span><span class="w" id="mwZQ"> </span><span class="o" id="mwZg">=</span><span class="w" id="mwZw"> </span><span class="p" id="mwaA">(</span><span class="kt" id="mwaQ">char</span><span class="o" id="mwag">*</span><span class="p" id="mwaw">)</span><span class="n" id="mwbA">malloc</span><span class="p" id="mwbQ">(</span><span class="k" id="mwbg">sizeof</span><span class="p" id="mwbw">(</span><span class="kt" id="mwcA">char</span><span class="p" id="mwcQ">)</span><span class="w" id="mwcg"> </span><span class="o" id="mwcw">*</span><span class="w" id="mwdA"> </span><span class="mi" id="mwdQ">10</span><span class="p" id="mwdg">);</span> <span class="w" id="mwdw"> </span><span class="c1" id="mweA">// ...</span> <span class="w" id="mweQ"> </span><span class="n" id="mweg">free</span><span class="p" id="mwew">(</span><span class="n" id="mwfA">dp</span><span class="p" id="mwfQ">);</span><span class="w" id="mwfg"> </span><span class="c1" id="mwfw">// dp now becomes a dangling pointer</span> <span class="w" id="mwgA"> </span><span class="n" id="mwgQ">dp</span><span class="w" id="mwgg"> </span><span class="o" id="mwgw">=</span><span class="w" id="mwhA"> </span><span class="nb" id="mwhQ">NULL</span><span class="p" id="mwhg">;</span><span class="w" id="mwhw"> </span><span class="c1" id="mwiA">// dp is no longer dangling</span> <span class="w" id="mwiQ"> </span><span class="c1" id="mwig">// ... </span> <span class="p" id="mwiw">}</span>

An all too common misstep is returning addresses of a stack-allocated local variable: once a called function returns, the space for these variables gets deallocated and technically they have "garbage values".

<span id="mwjw"></span><span class="kt" id="mwkA">int</span><span class="o" id="mwkQ">*</span><span class="w" id="mwkg"> </span><span class="nf" id="mwkw">func</span><span class="p" id="mwlA">(</span><span class="kt" id="mwlQ">void</span><span class="p" id="mwlg">)</span><span class="w" id="mwlw"> </span><span class="p" id="mwmA">{</span> <span class="w" id="mwmQ"> </span><span class="kt" id="mwmg">int</span><span class="w" id="mwmw"> </span><span class="n" id="mwnA">num</span><span class="w" id="mwnQ"> </span><span class="o" id="mwng">=</span><span class="w" id="mwnw"> </span><span class="mi" id="mwoA">1234</span><span class="p" id="mwoQ">;</span> <span class="w" id="mwog"> </span><span class="c1" id="mwow">// ... </span> <span class="w" id="mwpA"> </span><span class="k" id="mwpQ">return</span><span class="w" id="mwpg"> </span><span class="o" id="mwpw">&</span><span class="n" id="mwqA">num</span><span class="p" id="mwqQ">;</span> <span class="p" id="mwqg">}</span>

Attempts to read from the pointer may still return the correct value (1234) for a while after calling func, but any functions called thereafter may overwrite the stack storage allocated for num with other values and the pointer would no longer work correctly. If a pointer to num must be returned, num must have scope beyond the function—it might be declared as static.

5 more chapters are free with a Lably account.

Manual deallocation without dangling reference

Antoni Kreczmar (1945–1996) has created a complete object management system which is free of dangling reference phenomenon. A similar approach was proposed by Fisher and LeBlanc under the name Locks-and-keys.

Cause of wild pointers

Wild pointers are created by omitting necessary initialization prior to first use. Thus, strictly speaking, every pointer in programming languages which do not enforce initialization begins as a wild pointer.

This most often occurs due to jumping over the initialization, not by omitting it. Most compilers are able to warn about this.

<span id="mwxQ"></span><span class="kt" id="mwxg">int</span><span class="w" id="mwxw"> </span><span class="nf" id="mwyA">f</span><span class="p" id="mwyQ">(</span><span class="kt" id="mwyg">int</span><span class="w" id="mwyw"> </span><span class="n" id="mwzA">i</span><span class="p" id="mwzQ">)</span><span class="w" id="mwzg"> </span><span class="p" id="mwzw">{</span> <span class="w" id="mw0A"> </span><span class="kt" id="mw0Q">char</span><span class="o" id="mw0g">*</span><span class="w" id="mw0w"> </span><span class="n" id="mw1A">dp</span><span class="p" id="mw1Q">;</span><span class="w" id="mw1g"> </span><span class="c1" id="mw1w">// dp is a wild pointer </span> <span class="w" id="mw2A"> </span><span class="k" id="mw2Q">static</span><span class="w" id="mw2g"> </span><span class="kt" id="mw2w">char</span><span class="o" id="mw3A">*</span><span class="w" id="mw3Q"> </span><span class="n" id="mw3g">scp</span><span class="p" id="mw3w">;</span><span class="w" id="mw4A"> </span><span class="cm" id="mw4Q">/* scp is not a wild pointer:</span> <span class="cm" id="mw4g"> * static variables are initialized to 0</span> <span class="cm" id="mw4w"> * at start and retain their values from</span> <span class="cm" id="mw5A"> * the last call afterwards.</span> <span class="cm" id="mw5Q"> * Using this feature may be considered bad</span> <span class="cm" id="mw5g"> * style if not commented */</span> <span class="p" id="mw5w">}</span>

Security holes involving dangling pointers

Like buffer-overflow bugs, dangling/wild pointer bugs frequently become security holes. For example, if the pointer is used to make a virtual function call, a different address (possibly pointing at exploit code) may be called due to the vtable pointer being overwritten. Alternatively, if the pointer is used for writing to memory, some other data structure may be corrupted. Even if the memory is only read once the pointer becomes dangling, it can lead to information leaks (if interesting data is put in the next structure allocated there) or to privilege escalation (if the now-invalid memory is used in security checks). When a dangling pointer is used after it has been freed without allocating a new chunk of memory to it, this becomes known as a "use after free" vulnerability. For example, CVE-2014-1776 is a use-after-free vulnerability in Microsoft Internet Explorer 6 through 11 that was used by zero-day attacks by an advanced persistent threat.

Avoiding dangling pointer errors

In C, the simplest technique is to implement an alternative version of the free() (or alike) function which guarantees the reset of the pointer. However, this technique will not clear other pointer variables which may contain a copy of the pointer.

<span id="mwAQM"></span><span class="cp" id="mwAQQ">#include</span><span class="w" id="mwAQU"> </span><span class="cpf" id="mwAQY"><assert.h></span> <span class="cp" id="mwAQc">#include</span><span class="w" id="mwAQg"> </span><span class="cpf" id="mwAQk"><stdlib.h></span> <span class="c1" id="mwAQo">// Safe version of free()</span> <span class="k" id="mwAQs">static</span><span class="w" id="mwAQw"> </span><span class="kt" id="mwAQ0">void</span><span class="w" id="mwAQ4"> </span><span class="nf" id="mwAQ8">safeFree</span><span class="p" id="mwARA">(</span><span class="kt" id="mwARE">void</span><span class="o" id="mwARI">**</span><span class="w" id="mwARM"> </span><span class="n" id="mwARQ">pp</span><span class="p" id="mwARU">)</span><span class="w" id="mwARY"> </span><span class="p" id="mwARc">{</span> <span class="w" id="mwARg"> </span><span class="c1" id="mwARk">// in debug mode, abort if pp is NULL</span> <span class="w" id="mwARo"> </span><span class="n" id="mwARs">assert</span><span class="p" id="mwARw">(</span><span class="n" id="mwAR0">pp</span><span class="p" id="mwAR4">);</span> <span class="w" id="mwAR8"> </span><span class="c1" id="mwASA">// free(NULL) works properly, so no check is required besides the assert in debug mode</span> <span class="w" id="mwASE"> </span><span class="n" id="mwASI">free</span><span class="p" id="mwASM">(</span><span class="o" id="mwASQ">*</span><span class="n" id="mwASU">pp</span><span class="p" id="mwASY">);</span><span class="w" id="mwASc"> </span><span class="c1" id="mwASg">// deallocate chunk, note that free(NULL) is valid</span> <span class="w" id="mwASk"> </span><span class="o" id="mwASo">*</span><span class="n" id="mwASs">pp</span><span class="w" id="mwASw"> </span><span class="o" id="mwAS0">=</span><span class="w" id="mwAS4"> </span><span class="nb" id="mwAS8">NULL</span><span class="p" id="mwATA">;</span><span class="w" id="mwATE"> </span><span class="c1" id="mwATI">// reset original pointer</span> <span class="p" id="mwATM">}</span> <span class="kt" id="mwATQ">int</span><span class="w" id="mwATU"> </span><span class="nf" id="mwATY">f</span><span class="p" id="mwATc">(</span><span class="kt" id="mwATg">int</span><span class="w" id="mwATk"> </span><span class="n" id="mwATo">i</span><span class="p" id="mwATs">)</span><span class="w" id="mwATw"> </span><span class="p" id="mwAT0">{</span> <span class="w" id="mwAT4"> </span><span class="kt" id="mwAT8">char</span><span class="o" id="mwAUA">*</span><span class="w" id="mwAUE"> </span><span class="n" id="mwAUI">p</span><span class="w" id="mwAUM"> </span><span class="o" id="mwAUQ">=</span><span class="w" id="mwAUU"> </span><span class="nb" id="mwAUY">NULL</span><span class="p" id="mwAUc">;</span> <span class="w" id="mwAUg"> </span><span class="kt" id="mwAUk">char</span><span class="o" id="mwAUo">*</span><span class="w" id="mwAUs"> </span><span class="n" id="mwAUw">p2</span><span class="p" id="mwAU0">;</span> <span class="w" id="mwAU4"> </span><span class="n" id="mwAU8">p</span><span class="w" id="mwAVA"> </span><span class="o" id="mwAVE">=</span><span class="w" id="mwAVI"> </span><span class="p" id="mwAVM">(</span><span class="kt" id="mwAVQ">char</span><span class="o" id="mwAVU">*</span><span class="p" id="mwAVY">)</span><span class="n" id="mwAVc">malloc</span><span class="p" id="mwAVg">(</span><span class="mi" id="mwAVk">1000</span><span class="p" id="mwAVo">);</span><span class="w" id="mwAVs"> </span><span class="c1" id="mwAVw">// get a chunk</span> <span class="w" id="mwAV0"> </span><span class="n" id="mwAV4">p2</span><span class="w" id="mwAV8"> </span><span class="o" id="mwAWA">=</span><span class="w" id="mwAWE"> </span><span class="n" id="mwAWI">p</span><span class="p" id="mwAWM">;</span><span class="w" id="mwAWQ"> </span><span class="c1" id="mwAWU">// copy the pointer</span> <span class="w" id="mwAWY"> </span><span class="c1" id="mwAWc">// use the chunk here</span> <span class="w" id="mwAWg"> </span><span class="n" id="mwAWk">safeFree</span><span class="p" id="mwAWo">((</span><span class="kt" id="mwAWs">void</span><span class="o" id="mwAWw">**</span><span class="p" id="mwAW0">)</span><span class="o" id="mwAW4">&</span><span class="n" id="mwAW8">p</span><span class="p" id="mwAXA">);</span><span class="w" id="mwAXE"> </span><span class="c1" id="mwAXI">// safety freeing; does not affect p2 variable</span> <span class="w" id="mwAXM"> </span><span class="n" id="mwAXQ">safeFree</span><span class="p" id="mwAXU">((</span><span class="kt" id="mwAXY">void</span><span class="o" id="mwAXc">**</span><span class="p" id="mwAXg">)</span><span class="o" id="mwAXk">&</span><span class="n" id="mwAXo">p</span><span class="p" id="mwAXs">);</span><span class="w" id="mwAXw"> </span><span class="c1" id="mwAX0">// this second call won't fail as p is reset to NULL</span> <span class="w" id="mwAX4"> </span><span class="kt" id="mwAX8">char</span><span class="w" id="mwAYA"> </span><span class="n" id="mwAYE">c</span><span class="w" id="mwAYI"> </span><span class="o" id="mwAYM">=</span><span class="w" id="mwAYQ"> </span><span class="o" id="mwAYU">*</span><span class="n" id="mwAYY">p2</span><span class="p" id="mwAYc">;</span><span class="w" id="mwAYg"> </span><span class="c1" id="mwAYk">// p2 is still a dangling pointer, so this is undefined behavior.</span> <span class="w" id="mwAYo"> </span><span class="k" id="mwAYs">return</span><span class="w" id="mwAYw"> </span><span class="n" id="mwAY0">i</span><span class="w" id="mwAY4"> </span><span class="o" id="mwAY8">+</span><span class="w" id="mwAZA"> </span><span class="n" id="mwAZE">c</span><span class="p" id="mwAZI">;</span> <span class="p" id="mwAZM">}</span>

The alternative version can be used even to guarantee the validity of an empty pointer before calling malloc():

<span id="mwAZg"></span><span class="n" id="mwAZk">safeFree</span><span class="p" id="mwAZo">(</span><span class="o" id="mwAZs">&</span><span class="n" id="mwAZw">p</span><span class="p" id="mwAZ0">);</span><span class="w" id="mwAZ4"> </span><span class="c1" id="mwAZ8">// I'm not sure if chunk has been released */</span> <span class="n" id="mwAaA">p</span><span class="w" id="mwAaE"> </span><span class="o" id="mwAaI">=</span><span class="w" id="mwAaM"> </span><span class="p" id="mwAaQ">(</span><span class="kt" id="mwAaU">char</span><span class="o" id="mwAaY">*</span><span class="p" id="mwAac">)</span><span class="n" id="mwAag">malloc</span><span class="p" id="mwAak">(</span><span class="mi" id="mwAao">1000</span><span class="p" id="mwAas">);</span><span class="w" id="mwAaw"> </span><span class="c1" id="mwAa0">// allocate now</span>

These uses can be masked through #define directives to construct useful macros (a common one being #define XFREE(ptr) safeFree((void**)&(ptr))), creating something like a metalanguage or can be embedded into a tool library apart. In every case, programmers using this technique should use the safe versions in every instance where free() would be used; failing in doing so leads again to the problem. Also, this solution is limited to the scope of a single program or project, and should be properly documented.

Among more structured solutions, a popular technique to avoid dangling pointers in C++ is to use smart pointers. A smart pointer typically uses reference counting to reclaim objects. Some other techniques include the tombstones method and the locks-and-keys method.

Another approach is to use the Boehm garbage collector, a conservative garbage collector that replaces standard memory allocation functions in C and C++ with a garbage collector. This approach completely eliminates dangling pointer errors by disabling frees, and reclaiming objects by garbage collection.

Another approach is to use a system such as CHERI, which stores pointers with additional metadata which may prevent invalid accesses by including lifetime information in pointers. CHERI typically requires support in the CPU to conduct these additional checks.

In languages like Java, dangling pointers cannot occur because there is no mechanism to explicitly deallocate memory. Rather, the garbage collector may deallocate memory, but only when the object is no longer reachable from any references.

In the language Rust, the type system has been extended to include also the variables lifetimes and resource acquisition is initialization. Unless one disables the features of the language, dangling pointers will be caught at compile time and reported as programming errors.

Dangling pointer detection

To expose dangling pointer errors, one common programming technique is to set pointers to the null pointer or to an invalid address once the storage they point to has been released. When the null pointer is dereferenced (in most languages) the program will immediately terminate—there is no potential for data corruption or unpredictable behavior. This makes the underlying programming mistake easier to find and resolve. This technique does not help when there are multiple copies of the pointer.

Some debuggers will automatically overwrite and destroy data that has been freed, usually with a specific pattern, such as 0xDEADBEEF (Microsoft's Visual C/C++ debugger, for example, uses 0xCC, 0xCD or 0xDD depending on what has been freed). This usually prevents the data from being reused by making it useless and also very prominent (the pattern serves to show the programmer that the memory has already been freed).

Tools such as Polyspace, TotalView, Valgrind, Mudflap, AddressSanitizer, or tools based on LLVM can also be used to detect uses of dangling pointers.

Other tools (SoftBound, Insure++, and CheckPointer) instrument the source code to collect and track legitimate values for pointers ("metadata") and check each pointer access against the metadata for validity.

Another strategy, when suspecting a small set of classes, is to temporarily make all their member functions virtual: after the class instance has been destructed/freed, its pointer to the Virtual Method Table is set to NULL, and any call to a member function will crash the program and it will show the guilty code in the debugger.

The ARM64 memory tagging extension (MTE) - disabled by default on Linux systems, but can be enabled on Android 16 - triggers a segmentation fault when it detects use-after-free and buffer overflow.