@@ -15,7 +15,31 @@ predicate allocationFunction(Function f)
1515 name = "wcsdup" or
1616 name = "_strdup" or
1717 name = "_wcsdup" or
18- name = "_mbsdup"
18+ name = "_mbsdup" or
19+ name = "ExAllocatePool" or
20+ name = "ExAllocatePoolWithTag" or
21+ name = "ExAllocatePoolWithTagPriority" or
22+ name = "ExAllocatePoolWithQuota" or
23+ name = "ExAllocatePoolWithQuotaTag" or
24+ name = "ExAllocateFromLookasideListEx" or
25+ name = "ExAllocateFromPagedLookasideList" or
26+ name = "ExAllocateFromNPagedLookasideList" or
27+ name = "ExAllocateTimer" or
28+ name = "IoAllocateMdl" or
29+ name = "IoAllocateWorkItem" or
30+ name = "IoAllocateErrorLogEntry" or
31+ name = "MmAllocateContiguousMemory" or
32+ name = "MmAllocateContiguousNodeMemory" or
33+ name = "MmAllocateContiguousMemorySpecifyCache" or
34+ name = "MmAllocateContiguousMemorySpecifyCacheNode" or
35+ name = "MmAllocateNonCachedMemory" or
36+ name = "MmAllocateMappingAddress" or
37+ name = "MmAllocatePagesForMdl" or
38+ name = "MmAllocatePagesForMdlEx" or
39+ name = "MmAllocateNodePagesForMdlEx" or
40+ name = "MmMapLockedPagesWithReservedMapping" or
41+ name = "MmMapLockedPages" or
42+ name = "MmMapLockedPagesSpecifyCache"
1943 )
2044 )
2145}
@@ -42,7 +66,22 @@ predicate freeFunction(Function f, int argNum)
4266 f .hasQualifiedName ( name ) and
4367 (
4468 ( name = "free" and argNum = 0 ) or
45- ( name = "realloc" and argNum = 0 )
69+ ( name = "realloc" and argNum = 0 ) or
70+ ( name = "ExFreePoolWithTag" and argNum = 0 ) or
71+ ( name = "ExFreeToLookasideListEx" and argNum = 1 ) or
72+ ( name = "ExFreeToPagedLookasideList" and argNum = 1 ) or
73+ ( name = "ExFreeToNPagedLookasideList" and argNum = 1 ) or
74+ ( name = "ExDeleteTimer" and argNum = 0 ) or
75+ ( name = "IoFreeMdl" and argNum = 0 ) or
76+ ( name = "IoFreeWorkItem" and argNum = 0 ) or
77+ ( name = "IoFreeErrorLogEntry" and argNum = 0 ) or
78+ ( name = "MmFreeContiguousMemory" and argNum = 0 ) or
79+ ( name = "MmFreeContiguousMemorySpecifyCache" and argNum = 0 ) or
80+ ( name = "MmFreeNonCachedMemory" and argNum = 0 ) or
81+ ( name = "MmFreeMappingAddress" and argNum = 0 ) or
82+ ( name = "MmFreePagesFromMdl" and argNum = 0 ) or
83+ ( name = "MmUnmapReservedMapping" and argNum = 0 ) or
84+ ( name = "MmUnmapLockedPages" and argNum = 0 )
4685 )
4786 )
4887}
0 commit comments