Add files via upload

Author: ihsinme

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-415/semmle/tests/DoubleFree.expected

@@ -1,2 +1,4 @@
-| test.c:9:8:9:10 | buf | This pointer may be cleared again later. |
-| test.c:19:26:19:29 | buf1 | This pointer may be cleared again later. |
+| test.c:11:16:11:18 | buf | This pointer may have already been cleared in the line 10. |
+| test.c:18:8:18:10 | buf | This pointer may have already been cleared in the line 17. |
+| test.c:57:8:57:10 | buf | This pointer may have already been cleared in the line 55. |
+| test.c:78:8:78:10 | buf | This pointer may have already been cleared in the line 77. |

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-415/semmle/tests/test.c

@@ -1,21 +1,96 @@
 typedef unsigned long size_t;
 void *malloc(size_t size);
 void free(void *ptr);
+#define NULL 0
 
 void workFunction_0(char *s) {
   int intSize = 10;
   char *buf;
   buf = (char *) malloc(intSize);
-  free(buf); // BAD
-  if(buf) free(buf);
+  free(buf); // GOOD
+  if(buf) free(buf); // BAD
 }
 void workFunction_1(char *s) {
+  int intSize = 10;
+  char *buf;
+  buf = (char *) malloc(intSize);
+  free(buf); // GOOD
+  free(buf); // BAD
+}
+void workFunction_2(char *s) {
+  int intSize = 10;
+  char *buf;
+  buf = (char *) malloc(intSize);
+  free(buf); // GOOD
+  buf = NULL;
+  free(buf);
+}
+void workFunction_3(char *s) {
+  int intSize = 10;
+  char *buf;
+  int intFlag;
+  buf = (char *) malloc(intSize);
+  if(buf[1]%5) {
+    free(buf);
+    buf = NULL;
+  }
+  free(buf);
+}
+void workFunction_4(char *s) {
+  int intSize = 10;
+  char *buf;
+  char *tmpbuf;
+  tmpbuf = (char *) malloc(intSize);
+  buf = (char *) malloc(intSize);
+  free(buf); // GOOD
+  buf = tmpbuf;
+  free(buf); // GOOD
+}
+void workFunction_5(char *s) {
+  int intSize = 10;
+  char *buf;
+  int intFlag;
+  buf = (char *) malloc(intSize);
+  if(intFlag) {
+    free(buf);
+  }
+  free(buf); // BAD
+}
+void workFunction_6(char *s) {
+  int intSize = 10;
+  char *buf;
+  char *tmpbuf;
+  int intFlag;
+  tmpbuf = (char *) malloc(intSize);
+  buf = (char *) malloc(intSize);
+  if(intFlag) {
+    free(buf);
+    buf = tmpbuf;
+  }
+  free(buf);
+}
+void workFunction_7(char *s) {
+  int intSize = 10;
+  char *buf;
+  char *buf1;
+  buf = (char *) malloc(intSize);
+  buf1 = (char *) realloc(buf,intSize*4);
+  free(buf); // BAD
+}
+void workFunction_8(char *s) {
+  int intSize = 10;
+  char *buf;
+  char *buf1;
+  buf = (char *) malloc(intSize);
+  buf1 = (char *) realloc(buf,intSize*4);
+  if(!buf1)
+  free(buf); // GOOD
+}
+void workFunction_9(char *s) {
   int intSize = 10;
   char *buf;
   char *buf1;
   buf = (char *) malloc(intSize);
-  buf1 = (char *) realloc(buf,intSize*2);
-  if(buf) free(buf); // GOOD
-  buf = (char *) realloc(buf1,intSize*4); // BAD
-  free(buf1);
+  if(!(buf1 = (char *) realloc(buf,intSize*4)))
+  free(buf); // GOOD
 }