mismatched-memory-management-cpp.yaml

rules:
  - id: raptor-mismatched-memory-management-cpp
    metadata:
      author: Marco Ivaldi <raptor@0xdeadbeef.info>
      references:
        - https://cwe.mitre.org/data/definitions/762
        - https://cwe.mitre.org/data/definitions/590
        - https://github.com/struct/mms
        - https://docs.microsoft.com/en-us/cpp/sanitizers/asan-error-examples
      confidence: LOW
      # NOTE: valloc(), reallocf(), aligned_alloc(), and custom wrappers
      # are not covered.
      # NOTE: overloaded operators, VirtualAlloc()/VirtualFree(),
      # mmap()/munmap() are not covered.
    message: >-
      The software attempts to return a memory resource to the system, but
      it calls a release function that is not compatible with the function
      that was originally used to allocate that resource.
      Due to inherent limitations of Semgrep, this rule might generate many
      false positives and should therefore be customized for your codebase.
    severity: INFO
    languages:
      - cpp
    pattern-either:
      # free
      - patterns:
        - pattern: free($PTR);
        - pattern-not-inside: |
            $PTR = malloc(...);
            ...
            free($PTR);
        - pattern-not-inside: |
            $PTR = ($CAST)malloc(...);
            ...
            free($PTR);
        - pattern-not-inside: |
            $PTR = calloc(...);
            ...
            free($PTR);
        - pattern-not-inside: |
            $PTR = ($CAST)calloc(...);
            ...
            free($PTR);
        - pattern-not-inside: |
            $PTR = realloc(...);
            ...
            free($PTR);
        - pattern-not-inside: |
            $PTR = ($CAST)realloc(...);
            ...
            free($PTR); 
        - pattern-not-inside: |
            $PTR = strdup(...);
            ...
            free($PTR); 
        - pattern-not-inside: |
            $PTR = strndup(...);
            ...
            free($PTR); 
      # delete[]
      - patterns:
        - pattern: delete[]($PTR);
        - pattern-not-inside: |
            $PTR = new $OBJ[$SIZE];
            ...
            delete[]($PTR);
      # delete
      - patterns:
        - pattern: delete($PTR);
        - pattern-not-inside: |
            $PTR = new $OBJ;
            ...
            delete($PTR);
      - patterns:
        - pattern: delete($PTR);
        - pattern-inside: |
            $PTR = new $OBJ[$SIZE];
            ...
            delete($PTR);