@@ -11,32 +11,54 @@ class MallocAllocationFunction extends AllocationFunction {
1111 exists ( string name |
1212 hasGlobalOrStdName ( name ) and
1313 (
14- ( name = "malloc" and sizeArg = 0 ) // malloc(size)
14+ // malloc(size)
15+ ( name = "malloc" and sizeArg = 0 )
1516 )
1617 or
1718 hasGlobalName ( name ) and
1819 (
19- ( name = "ExAllocatePool" and sizeArg = 1 ) or // ExAllocatePool(type, size)
20- ( name = "ExAllocatePoolWithTag" and sizeArg = 1 ) or // ExAllocatePool(type, size, tag)
21- ( name = "ExAllocatePoolWithTagPriority" and sizeArg = 1 ) or // ExAllocatePoolWithTagPriority(type, size, tag, priority)
22- ( name = "ExAllocatePoolWithQuota" and sizeArg = 1 ) or // ExAllocatePoolWithQuota(type, size)
23- ( name = "ExAllocatePoolWithQuotaTag" and sizeArg = 1 ) or // ExAllocatePoolWithQuotaTag(type, size, tag)
24- ( name = "IoAllocateMdl" and sizeArg = 1 ) or // IoAllocateMdl(address, size, flag, flag, irp)
25- ( name = "IoAllocateErrorLogEntry" and sizeArg = 1 ) or // IoAllocateErrorLogEntry(object, size)
26- ( name = "MmAllocateContiguousMemory" and sizeArg = 0 ) or // MmAllocateContiguousMemory(size, maxaddress)
27- ( name = "MmAllocateContiguousNodeMemory" and sizeArg = 0 ) or // MmAllocateContiguousNodeMemory(size, minaddress, maxaddress, bound, flag, prefer)
28- ( name = "MmAllocateContiguousMemorySpecifyCache" and sizeArg = 0 ) or // MmAllocateContiguousMemorySpecifyCache(size, minaddress, maxaddress, bound, type)
29- ( name = "MmAllocateContiguousMemorySpecifyCacheNode" and sizeArg = 0 ) or // MmAllocateContiguousMemorySpecifyCacheNode(size, minaddress, maxaddress, bound, type, prefer)
30- ( name = "MmAllocateNonCachedMemory" and sizeArg = 0 ) or // MmAllocateNonCachedMemory(size)
31- ( name = "MmAllocateMappingAddress" and sizeArg = 0 ) or // MmAllocateMappingAddress(size, tag)
32- ( name = "MmAllocatePagesForMdl" and sizeArg = 3 ) or // MmAllocatePagesForMdl(minaddress, maxaddress, skip, size)
33- ( name = "MmAllocatePagesForMdlEx" and sizeArg = 3 ) or // MmAllocatePagesForMdlEx(minaddress, maxaddress, skip, size, type, flags)
34- ( name = "MmAllocateNodePagesForMdlEx" and sizeArg = 3 ) or // MmAllocateNodePagesForMdlEx(minaddress, maxaddress, skip, size, type, prefer, flags)
35- ( name = "LocalAlloc" and sizeArg = 1 ) or // LocalAlloc(flags, size)
36- ( name = "GlobalAlloc" and sizeArg = 1 ) or // GlobalAlloc(flags, size)
37- ( name = "HeapAlloc" and sizeArg = 2 ) or // HeapAlloc(heap, flags, size)
38- ( name = "VirtualAlloc" and sizeArg = 1 ) or // VirtualAlloc(address, size, type, flag)
39- ( name = "CoTaskMemAlloc" and sizeArg = 0 ) // CoTaskMemAlloc(size)
20+ // ExAllocatePool(type, size)
21+ ( name = "ExAllocatePool" and sizeArg = 1 ) or
22+ // ExAllocatePool(type, size, tag)
23+ ( name = "ExAllocatePoolWithTag" and sizeArg = 1 ) or
24+ // ExAllocatePoolWithTagPriority(type, size, tag, priority)
25+ ( name = "ExAllocatePoolWithTagPriority" and sizeArg = 1 ) or
26+ // ExAllocatePoolWithQuota(type, size)
27+ ( name = "ExAllocatePoolWithQuota" and sizeArg = 1 ) or
28+ // ExAllocatePoolWithQuotaTag(type, size, tag)
29+ ( name = "ExAllocatePoolWithQuotaTag" and sizeArg = 1 ) or
30+ // IoAllocateMdl(address, size, flag, flag, irp)
31+ ( name = "IoAllocateMdl" and sizeArg = 1 ) or
32+ // IoAllocateErrorLogEntry(object, size)
33+ ( name = "IoAllocateErrorLogEntry" and sizeArg = 1 ) or
34+ // MmAllocateContiguousMemory(size, maxaddress)
35+ ( name = "MmAllocateContiguousMemory" and sizeArg = 0 ) or
36+ // MmAllocateContiguousNodeMemory(size, minaddress, maxaddress, bound, flag, prefer)
37+ ( name = "MmAllocateContiguousNodeMemory" and sizeArg = 0 ) or
38+ // MmAllocateContiguousMemorySpecifyCache(size, minaddress, maxaddress, bound, type)
39+ ( name = "MmAllocateContiguousMemorySpecifyCache" and sizeArg = 0 ) or
40+ // MmAllocateContiguousMemorySpecifyCacheNode(size, minaddress, maxaddress, bound, type, prefer)
41+ ( name = "MmAllocateContiguousMemorySpecifyCacheNode" and sizeArg = 0 ) or
42+ // MmAllocateNonCachedMemory(size)
43+ ( name = "MmAllocateNonCachedMemory" and sizeArg = 0 ) or
44+ // MmAllocateMappingAddress(size, tag)
45+ ( name = "MmAllocateMappingAddress" and sizeArg = 0 ) or
46+ // MmAllocatePagesForMdl(minaddress, maxaddress, skip, size)
47+ ( name = "MmAllocatePagesForMdl" and sizeArg = 3 ) or
48+ // MmAllocatePagesForMdlEx(minaddress, maxaddress, skip, size, type, flags)
49+ ( name = "MmAllocatePagesForMdlEx" and sizeArg = 3 ) or
50+ // MmAllocateNodePagesForMdlEx(minaddress, maxaddress, skip, size, type, prefer, flags)
51+ ( name = "MmAllocateNodePagesForMdlEx" and sizeArg = 3 ) or
52+ // LocalAlloc(flags, size)
53+ ( name = "LocalAlloc" and sizeArg = 1 ) or
54+ // GlobalAlloc(flags, size)
55+ ( name = "GlobalAlloc" and sizeArg = 1 ) or
56+ // HeapAlloc(heap, flags, size)
57+ ( name = "HeapAlloc" and sizeArg = 2 ) or
58+ // VirtualAlloc(address, size, type, flag)
59+ ( name = "VirtualAlloc" and sizeArg = 1 ) or
60+ // CoTaskMemAlloc(size)
61+ ( name = "CoTaskMemAlloc" and sizeArg = 0 )
4062 )
4163 )
4264 }
@@ -57,7 +79,8 @@ class CallocAllocationFunction extends AllocationFunction {
5779 CallocAllocationFunction ( ) {
5880 exists ( string name |
5981 hasGlobalOrStdName ( name ) and
60- ( name = "calloc" and sizeArg = 1 and multArg = 0 ) // calloc(num, size)
82+ // calloc(num, size)
83+ ( name = "calloc" and sizeArg = 1 and multArg = 0 )
6184 )
6285 }
6386
@@ -81,15 +104,20 @@ class ReallocAllocationFunction extends AllocationFunction {
81104 ReallocAllocationFunction ( ) { exists ( string name |
82105 hasGlobalOrStdName ( name ) and
83106 (
84- ( name = "realloc" and sizeArg = 1 and reallocArg = 0 ) // realloc(ptr, size)
107+ // realloc(ptr, size)
108+ ( name = "realloc" and sizeArg = 1 and reallocArg = 0 )
85109 )
86110 or
87111 hasGlobalName ( name ) and
88112 (
89- ( name = "LocalReAlloc" and sizeArg = 1 and reallocArg = 0 ) or // LocalReAlloc(ptr, size, flags)
90- ( name = "GlobalReAlloc" and sizeArg = 1 and reallocArg = 0 ) or // GlobalReAlloc(ptr, size, flags)
91- ( name = "HeapReAlloc" and sizeArg = 3 and reallocArg = 2 ) or // HeapReAlloc(heap, flags, ptr, size)
92- ( name = "CoTaskMemRealloc" and sizeArg = 1 and reallocArg = 0 ) // CoTaskMemRealloc(ptr, size)
113+ // LocalReAlloc(ptr, size, flags)
114+ ( name = "LocalReAlloc" and sizeArg = 1 and reallocArg = 0 ) or
115+ // GlobalReAlloc(ptr, size, flags)
116+ ( name = "GlobalReAlloc" and sizeArg = 1 and reallocArg = 0 ) or
117+ // HeapReAlloc(heap, flags, ptr, size)
118+ ( name = "HeapReAlloc" and sizeArg = 3 and reallocArg = 2 ) or
119+ // CoTaskMemRealloc(ptr, size)
120+ ( name = "CoTaskMemRealloc" and sizeArg = 1 and reallocArg = 0 )
93121 )
94122 )
95123 }
@@ -112,23 +140,36 @@ class StrdupAllocationFunction extends AllocationFunction {
112140 exists ( string name |
113141 hasGlobalOrStdName ( name ) and
114142 (
115- name = "strdup" or // strdup(str)
116- name = "wcsdup" // wcsdup(str)
143+ // strdup(str)
144+ name = "strdup" or
145+ // wcsdup(str)
146+ name = "wcsdup"
117147 )
118148 or
119149 hasGlobalName ( name ) and
120150 (
121- name = "_strdup" or // _strdup(str)
122- name = "_wcsdup" or // _wcsdup(str)
123- name = "_mbsdup" or // _mbsdup(str)
124- name = "ExAllocateFromLookasideListEx" or // ExAllocateFromLookasideListEx(list)
125- name = "ExAllocateFromPagedLookasideList" or // ExAllocateFromPagedLookasideList(list)
126- name = "ExAllocateFromNPagedLookasideList" or // ExAllocateFromNPagedLookasideList(list)
127- name = "ExAllocateTimer" or // ExAllocateTimer(callback, context, attributes)
128- name = "IoAllocateWorkItem" or // IoAllocateWorkItem(object)
129- name = "MmMapLockedPagesWithReservedMapping" or // MmMapLockedPagesWithReservedMapping(address, tag, list, type)
130- name = "MmMapLockedPages" or // MmMapLockedPages(list, mode)
131- name = "MmMapLockedPagesSpecifyCache" // MmMapLockedPagesSpecifyCache(list, mode, type, address, flag, flag)
151+ // _strdup(str)
152+ name = "_strdup" or
153+ // _wcsdup(str)
154+ name = "_wcsdup" or
155+ // _mbsdup(str)
156+ name = "_mbsdup" or
157+ // ExAllocateFromLookasideListEx(list)
158+ name = "ExAllocateFromLookasideListEx" or
159+ // ExAllocateFromPagedLookasideList(list)
160+ name = "ExAllocateFromPagedLookasideList" or
161+ // ExAllocateFromNPagedLookasideList(list)
162+ name = "ExAllocateFromNPagedLookasideList" or
163+ // ExAllocateTimer(callback, context, attributes)
164+ name = "ExAllocateTimer" or
165+ // IoAllocateWorkItem(object)
166+ name = "IoAllocateWorkItem" or
167+ // MmMapLockedPagesWithReservedMapping(address, tag, list, type)
168+ name = "MmMapLockedPagesWithReservedMapping" or
169+ // MmMapLockedPages(list, mode)
170+ name = "MmMapLockedPages" or
171+ // MmMapLockedPagesSpecifyCache(list, mode, type, address, flag, flag)
172+ name = "MmMapLockedPagesSpecifyCache"
132173 )
133174 )
134175 }
0 commit comments