<!DOCTYPE qhelp PUBLIC

"-//Semmle//qhelp//EN"

"qhelp.dtd">

<qhelp>

<overview>

<p>Double freeing of a previously allocated resource can lead to various vulnerabilities in the program. Requires the attention of developers.</p>

</overview>

<recommendation>

<p>We recommend that you exclude situations of possible double release.</p>

</recommendation>

<example>

<p>The following example demonstrates an erroneous and corrected use of freeing a pointer.</p>

<sample src="DoubleFree.c" />

</example>

<references>

<li>

CERT C Coding Standard:

<a href="https://wiki.sei.cmu.edu/confluence/display/c/MEM30-C.+Do+not+access+freed+memory">MEM30-C. Do not access freed memory</a>.

</li>

</references>

</qhelp>

import cpp

ControlFlowNode recursASuccessor(FunctionCall fc, LocalScopeVariable v) {

result = fc

or

exists(ControlFlowNode mid |

mid = recursASuccessor(fc, v) and

result = mid.getASuccessor() and

not result = v.getAnAssignedValue() and

not result.(AddressOfExpr).getOperand() = v.getAnAccess() and

not (

not result instanceof DeallocationExpr and

result.(FunctionCall).getAnArgument().(VariableAccess).getTarget() = v

) and

(

fc.getTarget().hasGlobalOrStdName("realloc") and

(

not fc.getParent*() instanceof IfStmt and

not result instanceof IfStmt

)

or

not fc.getTarget().hasGlobalOrStdName("realloc")

)

)

from FunctionCall fc

exists(FunctionCall fc2, LocalScopeVariable v |

freeCall(fc, v.getAnAccess()) and

freeCall(fc2, v.getAnAccess()) and

fc != fc2 and

recursASuccessor(fc, v) = fc2

)

select fc.getArgument(0), "This pointer may be cleared again later."