Hands-On System Programming with Linux

Test case 9

Use After Return (UAR). Another classic bug, this one involves returning a storage item (or pointer to it) to the calling function. The issue is that the storage is local or automatic, thus implying that once the return is affected, the storage object is now out of scope.

The classic example is shown here: we allocate 32 bytes to a local variable, initialize it, and return it to the caller:

/* test case 9 : UAR (use-after-return) test case */static void * uar(void){    char name[32];        memset(name, 0, 32);    strncpy(name, "Hands-on Linux Sys Prg", 22);    return name;}

This is how the caller invokes the preceding buggy function:

[...]    case 9:            res = uar();            printf("res: %s\n", (char *)res);            break;[...]

Of course, once the return statement ...