codeql/cpp/ql/src/Critical/MemoryFreed.qll at codeql-cli/v2.19.2 · github/codeql · GitHub

27 lines (23 loc) · 642 Bytes

import semmle.code.cpp.pointsto.PointsTo

private predicate freed(Expr e) {

e = any(DeallocationExpr de).getFreedExpr()

exists(ExprCall c |

// cautiously assume that any `ExprCall` could be a deallocation expression.

c.getAnArgument() = e

)

}

/** An expression that might be deallocated. */

class FreedExpr extends PointsToExpr {

FreedExpr() { freed(this) }

override predicate interesting() { freed(this) }

}

/**

* An allocation expression that might be deallocated. For example:

* ```

* int* p = new int;

* ...

* delete p;

* ```

predicate allocMayBeFreed(AllocationExpr alloc) { anythingPointsTo(alloc) }

Expand file tree