Skip to content

Commit 7e70b30

Browse files
bdrodesbdrodes
committed
Adding missing windows library free functions to deallocation set
1 parent 67e43ec commit 7e70b30

File tree

1 file changed

+86
-82
lines changed

1 file changed

+86
-82
lines changed

‎cpp/ql/lib/semmle/code/cpp/models/implementations/Deallocation.qll‎

Lines changed: 86 additions & 82 deletions
Original file line numberDiff line numberDiff line change
@@ -4,86 +4,90 @@
44
* for usage information.
55
*/
66

7-
import semmle.code.cpp.models.interfaces.Deallocation
7+
import semmle.code.cpp.models.interfaces.Deallocation
88

9-
/**
10-
* A deallocation function such as `free`.
11-
*/
12-
private class StandardDeallocationFunction extends DeallocationFunction {
13-
int freedArg;
14-
15-
StandardDeallocationFunction() {
16-
this.hasGlobalOrStdOrBslName([
17-
// --- C library allocation
18-
"free", "realloc"
19-
]) and
20-
freedArg = 0
21-
or
22-
this.hasGlobalName([
23-
// --- OpenSSL memory allocation
24-
"CRYPTO_free", "CRYPTO_secure_free"
25-
]) and
26-
freedArg = 0
27-
or
28-
this.hasGlobalOrStdName([
29-
// --- Windows Memory Management for Windows Drivers
30-
"ExFreePoolWithTag", "ExDeleteTimer", "IoFreeMdl", "IoFreeWorkItem", "IoFreeErrorLogEntry",
31-
"MmFreeContiguousMemory", "MmFreeContiguousMemorySpecifyCache", "MmFreeNonCachedMemory",
32-
"MmFreeMappingAddress", "MmFreePagesFromMdl", "MmUnmapReservedMapping",
33-
"MmUnmapLockedPages",
34-
// --- Windows Global / Local legacy allocation
35-
"LocalFree", "GlobalFree", "LocalReAlloc", "GlobalReAlloc",
36-
// --- Windows System Services allocation
37-
"VirtualFree",
38-
// --- Windows COM allocation
39-
"CoTaskMemFree", "CoTaskMemRealloc",
40-
// --- Windows Automation
41-
"SysFreeString",
42-
// --- Solaris/BSD kernel memory allocator
43-
"kmem_free"
44-
]) and
45-
freedArg = 0
46-
or
47-
this.hasGlobalOrStdName([
48-
// --- Windows Memory Management for Windows Drivers
49-
"ExFreeToLookasideListEx", "ExFreeToPagedLookasideList", "ExFreeToNPagedLookasideList",
50-
// --- NetBSD pool manager
51-
"pool_put", "pool_cache_put"
52-
]) and
53-
freedArg = 1
54-
or
55-
this.hasGlobalOrStdName(["HeapFree", "HeapReAlloc"]) and
56-
freedArg = 2
57-
}
58-
59-
override int getFreedArg() { result = freedArg }
60-
}
61-
62-
/**
63-
* An deallocation expression that is a function call, such as call to `free`.
64-
*/
65-
private class CallDeallocationExpr extends DeallocationExpr, FunctionCall {
66-
DeallocationFunction target;
67-
68-
CallDeallocationExpr() { target = this.getTarget() }
69-
70-
override Expr getFreedExpr() { result = this.getArgument(target.getFreedArg()) }
71-
}
72-
73-
/**
74-
* An deallocation expression that is a `delete` expression.
75-
*/
76-
private class DeleteDeallocationExpr extends DeallocationExpr, DeleteExpr {
77-
DeleteDeallocationExpr() { this instanceof DeleteExpr }
78-
79-
override Expr getFreedExpr() { result = this.getExpr() }
80-
}
81-
82-
/**
83-
* An deallocation expression that is a `delete []` expression.
84-
*/
85-
private class DeleteArrayDeallocationExpr extends DeallocationExpr, DeleteArrayExpr {
86-
DeleteArrayDeallocationExpr() { this instanceof DeleteArrayExpr }
87-
88-
override Expr getFreedExpr() { result = this.getExpr() }
89-
}
9+
/**
10+
* A deallocation function such as `free`.
11+
*/
12+
private class StandardDeallocationFunction extends DeallocationFunction {
13+
int freedArg;
14+
15+
StandardDeallocationFunction() {
16+
this.hasGlobalOrStdOrBslName([
17+
// --- C library allocation
18+
"free", "realloc"
19+
]) and
20+
freedArg = 0
21+
or
22+
this.hasGlobalName([
23+
// --- OpenSSL memory allocation
24+
"CRYPTO_free", "CRYPTO_secure_free"
25+
]) and
26+
freedArg = 0
27+
or
28+
this.hasGlobalOrStdName([
29+
// --- Windows Memory Management for Windows Drivers
30+
"ExFreePool", "ExFreePoolWithTag", "ExDeleteTimer", "IoFreeIrp", "IoFreeMdl",
31+
"IoFreeErrorLogEntry", "IoFreeWorkItem", "MmFreeContiguousMemory",
32+
"MmFreeContiguousMemorySpecifyCache", "MmFreeNonCachedMemory", "MmFreeMappingAddress",
33+
"MmFreePagesFromMdl", "MmUnmapReservedMapping", "MmUnmapLockedPages",
34+
"NdisFreeGenericObject", "NdisFreeMemory", "NdisFreeMemoryWithTag", "NdisFreeMdl",
35+
"NdisFreeNetBufferListPool", "NdisFreeNetBufferPool",
36+
// --- Windows Global / Local legacy allocation
37+
"LocalFree", "GlobalFree", "LocalReAlloc", "GlobalReAlloc",
38+
// --- Windows System Services allocation
39+
"VirtualFree",
40+
// --- Windows COM allocation
41+
"CoTaskMemFree", "CoTaskMemRealloc",
42+
// --- Windows Automation
43+
"SysFreeString",
44+
// --- Solaris/BSD kernel memory allocator
45+
"kmem_free"
46+
]) and
47+
freedArg = 0
48+
or
49+
this.hasGlobalOrStdName([
50+
// --- Windows Memory Management for Windows Drivers
51+
"ExFreeToLookasideListEx", "ExFreeToPagedLookasideList", "ExFreeToNPagedLookasideList",
52+
"NdisFreeMemoryWithTagPriority", "StorPortFreeMdl", "StorPortFreePool",
53+
// --- NetBSD pool manager
54+
"pool_put", "pool_cache_put"
55+
]) and
56+
freedArg = 1
57+
or
58+
this.hasGlobalOrStdName(["HeapFree", "HeapReAlloc"]) and
59+
freedArg = 2
60+
}
61+
62+
override int getFreedArg() { result = freedArg }
63+
}
64+
65+
/**
66+
* An deallocation expression that is a function call, such as call to `free`.
67+
*/
68+
private class CallDeallocationExpr extends DeallocationExpr, FunctionCall {
69+
DeallocationFunction target;
70+
71+
CallDeallocationExpr() { target = this.getTarget() }
72+
73+
override Expr getFreedExpr() { result = this.getArgument(target.getFreedArg()) }
74+
}
75+
76+
/**
77+
* An deallocation expression that is a `delete` expression.
78+
*/
79+
private class DeleteDeallocationExpr extends DeallocationExpr, DeleteExpr {
80+
DeleteDeallocationExpr() { this instanceof DeleteExpr }
81+
82+
override Expr getFreedExpr() { result = this.getExpr() }
83+
}
84+
85+
/**
86+
* An deallocation expression that is a `delete []` expression.
87+
*/
88+
private class DeleteArrayDeallocationExpr extends DeallocationExpr, DeleteArrayExpr {
89+
DeleteArrayDeallocationExpr() { this instanceof DeleteArrayExpr }
90+
91+
override Expr getFreedExpr() { result = this.getExpr() }
92+
}
93+

0 commit comments

Comments
 (0)