44 * for usage information.
55 */
66
7- import semmle.code.cpp.models.interfaces.Deallocation
7+ import semmle.code.cpp.models.interfaces.Deallocation
88
9- /**
10- * A deallocation function such as `free`.
11- */
12- private class StandardDeallocationFunction extends DeallocationFunction {
13- int freedArg ;
14-
15- StandardDeallocationFunction ( ) {
16- this .hasGlobalOrStdOrBslName ( [
17- // --- C library allocation
18- "free" , "realloc"
19- ] ) and
20- freedArg = 0
21- or
22- this .hasGlobalName ( [
23- // --- OpenSSL memory allocation
24- "CRYPTO_free" , "CRYPTO_secure_free"
25- ] ) and
26- freedArg = 0
27- or
28- this .hasGlobalOrStdName ( [
29- // --- Windows Memory Management for Windows Drivers
30- "ExFreePool" , "ExFreePoolWithTag" , "ExDeleteTimer" , "IoFreeIrp" , "IoFreeMdl" ,
31- "IoFreeErrorLogEntry" , "IoFreeWorkItem" , "MmFreeContiguousMemory" ,
32- "MmFreeContiguousMemorySpecifyCache" , "MmFreeNonCachedMemory" , "MmFreeMappingAddress" ,
33- "MmFreePagesFromMdl" , "MmUnmapReservedMapping" , "MmUnmapLockedPages" ,
34- "NdisFreeGenericObject" , "NdisFreeMemory" , "NdisFreeMemoryWithTag" , "NdisFreeMdl" ,
35- "NdisFreeNetBufferListPool" , "NdisFreeNetBufferPool" ,
36- // --- Windows Global / Local legacy allocation
37- "LocalFree" , "GlobalFree" , "LocalReAlloc" , "GlobalReAlloc" ,
38- // --- Windows System Services allocation
39- "VirtualFree" ,
40- // --- Windows COM allocation
41- "CoTaskMemFree" , "CoTaskMemRealloc" ,
42- // --- Windows Automation
43- "SysFreeString" ,
44- // --- Solaris/BSD kernel memory allocator
45- "kmem_free"
46- ] ) and
47- freedArg = 0
48- or
49- this .hasGlobalOrStdName ( [
50- // --- Windows Memory Management for Windows Drivers
51- "ExFreeToLookasideListEx" , "ExFreeToPagedLookasideList" , "ExFreeToNPagedLookasideList" ,
52- "NdisFreeMemoryWithTagPriority" , "StorPortFreeMdl" , "StorPortFreePool" ,
53- // --- NetBSD pool manager
54- "pool_put" , "pool_cache_put"
55- ] ) and
56- freedArg = 1
57- or
58- this .hasGlobalOrStdName ( [ "HeapFree" , "HeapReAlloc" ] ) and
59- freedArg = 2
60- }
61-
62- override int getFreedArg ( ) { result = freedArg }
63- }
64-
65- /**
66- * An deallocation expression that is a function call, such as call to `free`.
67- */
68- private class CallDeallocationExpr extends DeallocationExpr , FunctionCall {
69- DeallocationFunction target ;
70-
71- CallDeallocationExpr ( ) { target = this .getTarget ( ) }
72-
73- override Expr getFreedExpr ( ) { result = this .getArgument ( target .getFreedArg ( ) ) }
74- }
75-
76- /**
77- * An deallocation expression that is a `delete` expression.
78- */
79- private class DeleteDeallocationExpr extends DeallocationExpr , DeleteExpr {
80- DeleteDeallocationExpr ( ) { this instanceof DeleteExpr }
81-
82- override Expr getFreedExpr ( ) { result = this .getExpr ( ) }
83- }
84-
85- /**
86- * An deallocation expression that is a `delete []` expression.
87- */
88- private class DeleteArrayDeallocationExpr extends DeallocationExpr , DeleteArrayExpr {
89- DeleteArrayDeallocationExpr ( ) { this instanceof DeleteArrayExpr }
90-
91- override Expr getFreedExpr ( ) { result = this .getExpr ( ) }
92- }
93-
9+ /**
10+ * A deallocation function such as `free`.
11+ */
12+ private class StandardDeallocationFunction extends DeallocationFunction {
13+ int freedArg ;
14+
15+ StandardDeallocationFunction ( ) {
16+ this .hasGlobalOrStdOrBslName ( [
17+ // --- C library allocation
18+ "free" , "realloc"
19+ ] ) and
20+ freedArg = 0
21+ or
22+ this .hasGlobalName ( [
23+ // --- OpenSSL memory allocation
24+ "CRYPTO_free" , "CRYPTO_secure_free"
25+ ] ) and
26+ freedArg = 0
27+ or
28+ this .hasGlobalOrStdName ( [
29+ // --- Windows Memory Management for Windows Drivers
30+ "ExFreePool" , "ExFreePoolWithTag" , "ExDeleteTimer" , "IoFreeIrp" , "IoFreeMdl" ,
31+ "IoFreeErrorLogEntry" , "IoFreeWorkItem" , "MmFreeContiguousMemory" ,
32+ "MmFreeContiguousMemorySpecifyCache" , "MmFreeNonCachedMemory" , "MmFreeMappingAddress" ,
33+ "MmFreePagesFromMdl" , "MmUnmapReservedMapping" , "MmUnmapLockedPages" ,
34+ "NdisFreeGenericObject" , "NdisFreeMemory" , "NdisFreeMemoryWithTag" , "NdisFreeMdl" ,
35+ "NdisFreeNetBufferListPool" , "NdisFreeNetBufferPool" ,
36+ // --- Windows Global / Local legacy allocation
37+ "LocalFree" , "GlobalFree" , "LocalReAlloc" , "GlobalReAlloc" ,
38+ // --- Windows System Services allocation
39+ "VirtualFree" ,
40+ // --- Windows COM allocation
41+ "CoTaskMemFree" , "CoTaskMemRealloc" ,
42+ // --- Windows Automation
43+ "SysFreeString" ,
44+ // --- Solaris/BSD kernel memory allocator
45+ "kmem_free"
46+ ] ) and
47+ freedArg = 0
48+ or
49+ this .hasGlobalOrStdName ( [
50+ // --- Windows Memory Management for Windows Drivers
51+ "ExFreeToLookasideListEx" , "ExFreeToPagedLookasideList" , "ExFreeToNPagedLookasideList" ,
52+ "NdisFreeMemoryWithTagPriority" , "StorPortFreeMdl" , "StorPortFreePool" ,
53+ // --- NetBSD pool manager
54+ "pool_put" , "pool_cache_put"
55+ ] ) and
56+ freedArg = 1
57+ or
58+ this .hasGlobalOrStdName ( [ "HeapFree" , "HeapReAlloc" ] ) and
59+ freedArg = 2
60+ }
61+
62+ override int getFreedArg ( ) { result = freedArg }
63+ }
64+
65+ /**
66+ * An deallocation expression that is a function call, such as call to `free`.
67+ */
68+ private class CallDeallocationExpr extends DeallocationExpr , FunctionCall {
69+ DeallocationFunction target ;
70+
71+ CallDeallocationExpr ( ) { target = this .getTarget ( ) }
72+
73+ override Expr getFreedExpr ( ) { result = this .getArgument ( target .getFreedArg ( ) ) }
74+ }
75+
76+ /**
77+ * An deallocation expression that is a `delete` expression.
78+ */
79+ private class DeleteDeallocationExpr extends DeallocationExpr , DeleteExpr {
80+ DeleteDeallocationExpr ( ) { this instanceof DeleteExpr }
81+
82+ override Expr getFreedExpr ( ) { result = this .getExpr ( ) }
83+ }
84+
85+ /**
86+ * An deallocation expression that is a `delete []` expression.
87+ */
88+ private class DeleteArrayDeallocationExpr extends DeallocationExpr , DeleteArrayExpr {
89+ DeleteArrayDeallocationExpr ( ) { this instanceof DeleteArrayExpr }
90+
91+ override Expr getFreedExpr ( ) { result = this .getExpr ( ) }
92+ }
0 commit comments