Unreleased Resource: Synchronization

The program fails to release a lock it holds, which might lead to deadlock.

The program can potentially fail to release a system resource.

Resource leaks have at least two common causes:

- Error conditions and other exceptional circumstances.

- Confusion over which part of the program is responsible for releasing the resource.

Most unreleased resource issues result in general software reliability problems. However, if an attacker can intentionally trigger a resource leak, the attacker may be able to launch a denial of service by depleting the resource pool.

Example 1: The following code establishes a lock before performOperationInCriticalSection(), but fails to release the lock if an exception is thrown in that method.

Object synchronizationObject = new Object ();

System.Threading.Monitor.Enter(synchronizationObject);
performOperationInCriticalSection();
System.Threading.Monitor.Exit(synchronizationObject);

The program fails to release a lock it holds, which might lead to deadlock.

The program can potentially fail to release a system resource.

Resource leaks have at least two common causes:

- Error conditions and other exceptional circumstances.

- Confusion over which part of the program is responsible for releasing the resource.

Most unreleased resource issues result in general software reliability problems. However, if an attacker can intentionally trigger a resource leak, the attacker may be able to launch a denial of service by depleting the resource pool.

Example 1: The following function does destroy the condition variable it allocates if an error occurs. If the process is long-lived, the process can run out of file handles.

int helper(char* fName)
{
   int status;
   ...
   pthread_cond_init (&count_threshold_cv, NULL);
   pthread_mutex_init(&count_mutex, NULL);

   status = perform_operation();
   if (status) {
      printf("%s", "cannot perform operation");
      return OPERATION_FAIL;
   }

   pthread_mutex_destroy(&count_mutex);
   pthread_cond_destroy(&count_threshold_cv);

   return OPERATION_SUCCESS;
}

The program fails to release a lock it holds, which might lead to deadlock.

The program can potentially fail to release a lock.

Resource leaks have at least two common causes:

- Error conditions and other exceptional circumstances.

- Confusion about which part of the program is responsible for releasing the resource.

Most unreleased resource issues result in general software reliability problems. However, if an attacker can intentionally trigger a resource leak, the attacker might launch a denial of service by depleting the resource pool or causing a deadlock.

Example 1: The following program does not release a record lock on a file if an error occurs.

  CALL "CBL_GET_RECORD_LOCK"
      USING file-handle
            record-offset
            record-length
            reserved
  END-CALL

  IF return-code NOT = 0
      DISPLAY "Error!"
      GOBACK
  ELSE
      PERFORM write-data
      IF ws-status-code NOT = 0
          DISPLAY "Error!"
          GOBACK
      ELSE
           DISPLAY "Success!"
      END-IF
  END-IF

  CALL "CBL_FREE_RECORD_LOCK"
      USING file-handle
            record-offset
            record-length
            reserved
  END-CALL

  GOBACK
  .

The program fails to release a lock it holds, which might lead to deadlock.

Resource leaks have at least two common causes:

- Error conditions and other exceptional circumstances.

- Confusion over which part of the program is responsible for releasing the resource.

Most unreleased resource issues result in general software reliability problems. However, if an attacker can intentionally trigger a resource leak, the attacker can launch a denial of service by depleting the resource pool.

Example 1: The following code establishes a lock before performOperationInCriticalSection() but never releases it.

os_unfair_lock lock1 = OS_UNFAIR_LOCK_INIT;
os_unfair_lock_lock(&lock1);
performOperationInCriticalSection();

The program fails to release a lock it holds, which might lead to deadlock.

Resource leaks have at least two common causes:

- Error conditions and other exceptional circumstances.

- Confusion over which part of the program is responsible for releasing the resource.

Most unreleased resource issues result in general software reliability problems. However, if an attacker can intentionally trigger a resource leak, the attacker can launch a denial of service by depleting the resource pool.

Example 1: The following code establishes a lock before performOperationInCriticalSection() but never releases it.

let lock1 = OSAllocatedUnfairLock()
lock1.lock()
performOperationInCriticalSection();