4
4
* for usage information.
5
5
*/
6
6
7
- import semmle.code.cpp.models.interfaces.Deallocation
7
+ import semmle.code.cpp.models.interfaces.Deallocation
8
8
9
- /**
10
- * A deallocation function such as `free`.
11
- */
12
- private class StandardDeallocationFunction extends DeallocationFunction {
13
- int freedArg ;
14
-
15
- StandardDeallocationFunction ( ) {
16
- this .hasGlobalOrStdOrBslName ( [
17
- // --- C library allocation
18
- "free" , "realloc"
19
- ] ) and
20
- freedArg = 0
21
- or
22
- this .hasGlobalName ( [
23
- // --- OpenSSL memory allocation
24
- "CRYPTO_free" , "CRYPTO_secure_free"
25
- ] ) and
26
- freedArg = 0
27
- or
28
- this .hasGlobalOrStdName ( [
29
- // --- Windows Memory Management for Windows Drivers
30
- "ExFreePool" , "ExFreePoolWithTag" , "ExDeleteTimer" , "IoFreeIrp" , "IoFreeMdl" ,
31
- "IoFreeErrorLogEntry" , "IoFreeWorkItem" , "MmFreeContiguousMemory" ,
32
- "MmFreeContiguousMemorySpecifyCache" , "MmFreeNonCachedMemory" , "MmFreeMappingAddress" ,
33
- "MmFreePagesFromMdl" , "MmUnmapReservedMapping" , "MmUnmapLockedPages" ,
34
- "NdisFreeGenericObject" , "NdisFreeMemory" , "NdisFreeMemoryWithTag" , "NdisFreeMdl" ,
35
- "NdisFreeNetBufferListPool" , "NdisFreeNetBufferPool" ,
36
- // --- Windows Global / Local legacy allocation
37
- "LocalFree" , "GlobalFree" , "LocalReAlloc" , "GlobalReAlloc" ,
38
- // --- Windows System Services allocation
39
- "VirtualFree" ,
40
- // --- Windows COM allocation
41
- "CoTaskMemFree" , "CoTaskMemRealloc" ,
42
- // --- Windows Automation
43
- "SysFreeString" ,
44
- // --- Solaris/BSD kernel memory allocator
45
- "kmem_free"
46
- ] ) and
47
- freedArg = 0
48
- or
49
- this .hasGlobalOrStdName ( [
50
- // --- Windows Memory Management for Windows Drivers
51
- "ExFreeToLookasideListEx" , "ExFreeToPagedLookasideList" , "ExFreeToNPagedLookasideList" ,
52
- "NdisFreeMemoryWithTagPriority" , "StorPortFreeMdl" , "StorPortFreePool" ,
53
- // --- NetBSD pool manager
54
- "pool_put" , "pool_cache_put"
55
- ] ) and
56
- freedArg = 1
57
- or
58
- this .hasGlobalOrStdName ( [ "HeapFree" , "HeapReAlloc" ] ) and
59
- freedArg = 2
60
- }
61
-
62
- override int getFreedArg ( ) { result = freedArg }
63
- }
64
-
65
- /**
66
- * An deallocation expression that is a function call, such as call to `free`.
67
- */
68
- private class CallDeallocationExpr extends DeallocationExpr , FunctionCall {
69
- DeallocationFunction target ;
70
-
71
- CallDeallocationExpr ( ) { target = this .getTarget ( ) }
72
-
73
- override Expr getFreedExpr ( ) { result = this .getArgument ( target .getFreedArg ( ) ) }
74
- }
75
-
76
- /**
77
- * An deallocation expression that is a `delete` expression.
78
- */
79
- private class DeleteDeallocationExpr extends DeallocationExpr , DeleteExpr {
80
- DeleteDeallocationExpr ( ) { this instanceof DeleteExpr }
81
-
82
- override Expr getFreedExpr ( ) { result = this .getExpr ( ) }
83
- }
84
-
85
- /**
86
- * An deallocation expression that is a `delete []` expression.
87
- */
88
- private class DeleteArrayDeallocationExpr extends DeallocationExpr , DeleteArrayExpr {
89
- DeleteArrayDeallocationExpr ( ) { this instanceof DeleteArrayExpr }
90
-
91
- override Expr getFreedExpr ( ) { result = this .getExpr ( ) }
92
- }
93
-
9
+ /**
10
+ * A deallocation function such as `free`.
11
+ */
12
+ private class StandardDeallocationFunction extends DeallocationFunction {
13
+ int freedArg ;
14
+
15
+ StandardDeallocationFunction ( ) {
16
+ this .hasGlobalOrStdOrBslName ( [
17
+ // --- C library allocation
18
+ "free" , "realloc"
19
+ ] ) and
20
+ freedArg = 0
21
+ or
22
+ this .hasGlobalName ( [
23
+ // --- OpenSSL memory allocation
24
+ "CRYPTO_free" , "CRYPTO_secure_free"
25
+ ] ) and
26
+ freedArg = 0
27
+ or
28
+ this .hasGlobalOrStdName ( [
29
+ // --- Windows Memory Management for Windows Drivers
30
+ "ExFreePool" , "ExFreePoolWithTag" , "ExDeleteTimer" , "IoFreeIrp" , "IoFreeMdl" ,
31
+ "IoFreeErrorLogEntry" , "IoFreeWorkItem" , "MmFreeContiguousMemory" ,
32
+ "MmFreeContiguousMemorySpecifyCache" , "MmFreeNonCachedMemory" , "MmFreeMappingAddress" ,
33
+ "MmFreePagesFromMdl" , "MmUnmapReservedMapping" , "MmUnmapLockedPages" ,
34
+ "NdisFreeGenericObject" , "NdisFreeMemory" , "NdisFreeMemoryWithTag" , "NdisFreeMdl" ,
35
+ "NdisFreeNetBufferListPool" , "NdisFreeNetBufferPool" ,
36
+ // --- Windows Global / Local legacy allocation
37
+ "LocalFree" , "GlobalFree" , "LocalReAlloc" , "GlobalReAlloc" ,
38
+ // --- Windows System Services allocation
39
+ "VirtualFree" ,
40
+ // --- Windows COM allocation
41
+ "CoTaskMemFree" , "CoTaskMemRealloc" ,
42
+ // --- Windows Automation
43
+ "SysFreeString" ,
44
+ // --- Solaris/BSD kernel memory allocator
45
+ "kmem_free"
46
+ ] ) and
47
+ freedArg = 0
48
+ or
49
+ this .hasGlobalOrStdName ( [
50
+ // --- Windows Memory Management for Windows Drivers
51
+ "ExFreeToLookasideListEx" , "ExFreeToPagedLookasideList" , "ExFreeToNPagedLookasideList" ,
52
+ "NdisFreeMemoryWithTagPriority" , "StorPortFreeMdl" , "StorPortFreePool" ,
53
+ // --- NetBSD pool manager
54
+ "pool_put" , "pool_cache_put"
55
+ ] ) and
56
+ freedArg = 1
57
+ or
58
+ this .hasGlobalOrStdName ( [ "HeapFree" , "HeapReAlloc" ] ) and
59
+ freedArg = 2
60
+ }
61
+
62
+ override int getFreedArg ( ) { result = freedArg }
63
+ }
64
+
65
+ /**
66
+ * An deallocation expression that is a function call, such as call to `free`.
67
+ */
68
+ private class CallDeallocationExpr extends DeallocationExpr , FunctionCall {
69
+ DeallocationFunction target ;
70
+
71
+ CallDeallocationExpr ( ) { target = this .getTarget ( ) }
72
+
73
+ override Expr getFreedExpr ( ) { result = this .getArgument ( target .getFreedArg ( ) ) }
74
+ }
75
+
76
+ /**
77
+ * An deallocation expression that is a `delete` expression.
78
+ */
79
+ private class DeleteDeallocationExpr extends DeallocationExpr , DeleteExpr {
80
+ DeleteDeallocationExpr ( ) { this instanceof DeleteExpr }
81
+
82
+ override Expr getFreedExpr ( ) { result = this .getExpr ( ) }
83
+ }
84
+
85
+ /**
86
+ * An deallocation expression that is a `delete []` expression.
87
+ */
88
+ private class DeleteArrayDeallocationExpr extends DeallocationExpr , DeleteArrayExpr {
89
+ DeleteArrayDeallocationExpr ( ) { this instanceof DeleteArrayExpr }
90
+
91
+ override Expr getFreedExpr ( ) { result = this .getExpr ( ) }
92
+ }
0 commit comments