detecting-incorrect-free
Detects incorrect use of free() including freeing non-heap memory, invalid pointers, and mismatched allocators. Use when analyzing memory deallocation, heap management, or investigating free() usage errors.
When & Why to Use This Skill
This Claude skill specializes in memory management analysis by detecting incorrect usage of the free() function and C++ deallocators. It identifies critical software defects such as freeing non-heap memory (stack or static variables), invalid or uninitialized pointers, and mismatched allocators (e.g., using free() on memory allocated with 'new'). By tracing pointer origins and assessing memory types, it helps developers prevent heap corruption, application crashes, and security vulnerabilities like double-free exploits.
Use Cases
- Case 1: Investigating intermittent application crashes or segmentation faults caused by heap corruption during memory deallocation.
- Case 2: Performing automated code reviews to identify mismatched memory management patterns, such as mixing C-style malloc/free with C++ new/delete.
- Case 3: Auditing legacy C/C++ codebases to detect security vulnerabilities related to double-free operations or freeing of static/global variables.
- Case 4: Debugging complex pointer logic where memory is allocated in one module and deallocated in another to ensure pointer validity at the point of release.
| name | detecting-incorrect-free |
|---|---|
| description | Detects incorrect use of free() including freeing non-heap memory, invalid pointers, and mismatched allocators. Use when analyzing memory deallocation, heap management, or investigating free() usage errors. |
Incorrect Use of Free Detection
Detection Workflow
- Identify free operations: Find all free() calls, locate delete/delete[] calls, map deallocation points, note pointers being freed
- Trace pointer origins: Find where pointers originate, identify allocation method, track pointer assignments, assess pointer validity
- Analyze memory type: Verify pointer points to heap memory, check for stack variables, identify static/global variables, assess pointer validity
- Assess impact: Can incorrect free cause crash? Can it cause heap corruption? What's the security impact? Is it exploitable?
Key Patterns
- Freeing non-heap memory: free() on stack variables, free() on static/global variables, free() on string literals, free() on automatic storage
- Freeing invalid pointers: free() on NULL pointer, free() on already-freed memory, free() on uninitialized pointers, free() on middle of allocations
- Mismatched allocators: free() on new-allocated memory, delete on malloc-allocated memory, cross-allocator deallocation, mixed C/C++ memory management
- Double free patterns: multiple free() on same pointer, free() in multiple code paths, free() in error handling, free() in cleanup functions
Output Format
Report with: id, type, subtype, severity, confidence, location, vulnerability, freed_pointer, pointer_type, allocation_type, free_operation, exploitable, attack_scenario, impact, mitigation.
Severity Guidelines
- HIGH: Incorrect free causing heap corruption
- MEDIUM: Incorrect free causing crashes
- LOW: Incorrect free with limited impact
See Also
patterns.md- Detailed detection patterns and exploitation scenariosexamples.md- Example analysis cases and code samplesreferences.md- CWE references and mitigation strategies