frequently become security holes. For example, if the pointer is used to make a virtual function call, a different address (possibly pointing at exploit code) may be called due to the vtable pointer being overwritten. Alternatively, if the pointer is used for writing to memory, some other data structure may be corrupted. Even if the memory is only read once the pointer becomes dangling, it can lead to information leaks (if interesting data is put in the next structure allocated there) or to privilege escalation (if the now-invalid memory is used in security checks). When a dangling pointer is used after it has been freed without allocating a new chunk of memory to it, this becomes known as a "use after free" vulnerability. For example, is a use-after-free vulnerability in Microsoft Internet Explorer 6 through 11 being used by zero-day attacks by an advanced persistent threat. Avoiding dangling pointer errors In C, the simplest technique is to implement an alternative version of the free() (or alike) function which guarantees the reset of the pointer. However, this technique will not clear other pointer variables which may contain a copy of the pointer. #include <assert.h> #include <stdlib.h> /* Alternative version for 'free()' */ static void safefree(void **pp) { /* in debug mode, abort if pp is NULL */ assert(pp); /* free(NULL) works properly, so no check is required besides the assert in debug mode */ free(*pp); /* deallocate chunk, note that free(NULL) is valid */ *pp = NULL; /* reset original pointer */ } int f(int i) { char *p = NULL, *p2; p = malloc(1000); /* get a chunk */ p2 = p; /* copy the pointer */ /* use the chunk here */ safefree((void **)&p); /* safety freeing; does not affect p2 variable */ safefree((void **)&p); /* this second call won't fail as p is reset to NULL */ char c = *p2; /* p2 is still a dangling pointer, so this is undefined behavior. */ return i + c; } The alternative version can be used even to guarantee the validity of an empty pointer before calling malloc(): safefree(&p); /* i'm not sure if chunk has been released */ p = malloc(1000); /* allocate now */ These uses can be masked through #define directives to construct useful macros (a common one being #define XFREE(ptr) safefree((void **)&(ptr))), creating something like a metalanguage or can be embedded into a tool library