Incorrect Use of Free Detection

Detection Workflow

1. •Identify free operations: Find all free() calls, locate delete/delete[] calls, map deallocation points, note pointers being freed
2. •Trace pointer origins: Find where pointers originate, identify allocation method, track pointer assignments, assess pointer validity
3. •Analyze memory type: Verify pointer points to heap memory, check for stack variables, identify static/global variables, assess pointer validity
4. •Assess impact: Can incorrect free cause crash? Can it cause heap corruption? What's the security impact? Is it exploitable?

Key Patterns

• •Freeing non-heap memory: free() on stack variables, free() on static/global variables, free() on string literals, free() on automatic storage
• •Freeing invalid pointers: free() on NULL pointer, free() on already-freed memory, free() on uninitialized pointers, free() on middle of allocations
• •Mismatched allocators: free() on new-allocated memory, delete on malloc-allocated memory, cross-allocator deallocation, mixed C/C++ memory management
• •Double free patterns: multiple free() on same pointer, free() in multiple code paths, free() in error handling, free() in cleanup functions

Output Format

Report with: id, type, subtype, severity, confidence, location, vulnerability, freed_pointer, pointer_type, allocation_type, free_operation, exploitable, attack_scenario, impact, mitigation.

Severity Guidelines

• •HIGH: Incorrect free causing heap corruption
• •MEDIUM: Incorrect free causing crashes
• •LOW: Incorrect free with limited impact

See Also

• •patterns.md - Detailed detection patterns and exploitation scenarios
• •examples.md - Example analysis cases and code samples
• •references.md - CWE references and mitigation strategies