Incorrect Use of Free Detection
Detection Workflow
- Identify free operations: Find all free() calls, locate delete/delete[] calls, map deallocation points, note pointers being freed
- Trace pointer origins: Find where pointers originate, identify allocation method, track pointer assignments, assess pointer validity
- Analyze memory type: Verify pointer points to heap memory, check for stack variables, identify static/global variables, assess pointer validity
- Assess impact: Can incorrect free cause crash? Can it cause heap corruption? What's the security impact? Is it exploitable?
Key Patterns
- Freeing non-heap memory: free() on stack variables, free() on static/global variables, free() on string literals, free() on automatic storage
- Freeing invalid pointers: free() on NULL pointer, free() on already-freed memory, free() on uninitialized pointers, free() on middle of allocations
- Mismatched allocators: free() on new-allocated memory, delete on malloc-allocated memory, cross-allocator deallocation, mixed C/C++ memory management
- Double free patterns: multiple free() on same pointer, free() in multiple code paths, free() in error handling, free() in cleanup functions
Output Format
Report with: id, type, subtype, severity, confidence, location, vulnerability, freed_pointer, pointer_type, allocation_type, free_operation, exploitable, attack_scenario, impact, mitigation.
Severity Guidelines
- HIGH: Incorrect free causing heap corruption
- MEDIUM: Incorrect free causing crashes
- LOW: Incorrect free with limited impact
See Also
patterns.md - Detailed detection patterns and exploitation scenariosexamples.md - Example analysis cases and code samplesreferences.md - CWE references and mitigation strategies
1---2name: detecting-incorrect-free3description: Detects incorrect use of free() including freeing non-heap memory, invalid pointers, and mismatched allocators. Use when analyzing memory deallocation, heap management, or investigating free() usage errors.4---5
6# Incorrect Use of Free Detection
7
8## Detection Workflow
9
101. **Identify free operations**: Find all free() calls, locate delete/delete[] calls, map deallocation points, note pointers being freed
112. **Trace pointer origins**: Find where pointers originate, identify allocation method, track pointer assignments, assess pointer validity
123. **Analyze memory type**: Verify pointer points to heap memory, check for stack variables, identify static/global variables, assess pointer validity
134. **Assess impact**: Can incorrect free cause crash? Can it cause heap corruption? What's the security impact? Is it exploitable?
14
15## Key Patterns
16
17- Freeing non-heap memory: free() on stack variables, free() on static/global variables, free() on string literals, free() on automatic storage
18- Freeing invalid pointers: free() on NULL pointer, free() on already-freed memory, free() on uninitialized pointers, free() on middle of allocations
19- Mismatched allocators: free() on new-allocated memory, delete on malloc-allocated memory, cross-allocator deallocation, mixed C/C++ memory management
20- Double free patterns: multiple free() on same pointer, free() in multiple code paths, free() in error handling, free() in cleanup functions
21
22## Output Format
23
24Report with: id, type, subtype, severity, confidence, location, vulnerability, freed_pointer, pointer_type, allocation_type, free_operation, exploitable, attack_scenario, impact, mitigation.
25
26## Severity Guidelines
27
28- **HIGH**: Incorrect free causing heap corruption
29- **MEDIUM**: Incorrect free causing crashes
30- **LOW**: Incorrect free with limited impact
31
32## See Also
33
34- `patterns.md` - Detailed detection patterns and exploitation scenarios
35- `examples.md` - Example analysis cases and code samples
36- `references.md` - CWE references and mitigation strategies
majiayu000