# Detecting Incorrect Free

> Detects incorrect use of free() including freeing non-heap memory, invalid pointers, and mismatched allocators. Use when analyzing memory deallocation, heap management, or investigating free() usage errors.

- Skill: `majiayu000/detecting-incorrect-free` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds add majiayu000/detecting-incorrect-free`
- Raw SKILL.md: https://api.skillmd.com/api/skills/majiayu000/detecting-incorrect-free/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: majiayu000 (https://skillmd.com/u/majiayu000)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/majiayu000/detecting-incorrect-free

---


# Incorrect Use of Free Detection

## Detection Workflow

1. **Identify free operations**: Find all free() calls, locate delete/delete[] calls, map deallocation points, note pointers being freed
2. **Trace pointer origins**: Find where pointers originate, identify allocation method, track pointer assignments, assess pointer validity
3. **Analyze memory type**: Verify pointer points to heap memory, check for stack variables, identify static/global variables, assess pointer validity
4. **Assess impact**: Can incorrect free cause crash? Can it cause heap corruption? What's the security impact? Is it exploitable?

## Key Patterns

- Freeing non-heap memory: free() on stack variables, free() on static/global variables, free() on string literals, free() on automatic storage
- Freeing invalid pointers: free() on NULL pointer, free() on already-freed memory, free() on uninitialized pointers, free() on middle of allocations
- Mismatched allocators: free() on new-allocated memory, delete on malloc-allocated memory, cross-allocator deallocation, mixed C/C++ memory management
- Double free patterns: multiple free() on same pointer, free() in multiple code paths, free() in error handling, free() in cleanup functions

## Output Format

Report with: id, type, subtype, severity, confidence, location, vulnerability, freed_pointer, pointer_type, allocation_type, free_operation, exploitable, attack_scenario, impact, mitigation.

## Severity Guidelines

- **HIGH**: Incorrect free causing heap corruption
- **MEDIUM**: Incorrect free causing crashes
- **LOW**: Incorrect free with limited impact

## See Also

- `patterns.md` - Detailed detection patterns and exploitation scenarios
- `examples.md` - Example analysis cases and code samples
- `references.md` - CWE references and mitigation strategies