warning: double-‘free’ of ‘ptr’ [CWE-415] [-Wanalyzer-double-free]
Function wrapped_free
File ../../src/gcc/testsuite/gcc.dg/analyzer/malloc-ipa-8-double-free.c
Line 15
Column 3
15 free (ptr); /* { dg-warning "double-'free' of 'ptr' \\\[CWE-415\\\]" } */
^~~~~~~~~~
Execution path with 23 events
test
test: events 1-2
39 void test (int i)
^~~~
|
(1) entry to ‘test’
40 {
41 boxed_int *obj = make_boxed_int (i);
~~~~~~~~~~~~~~~~~~
|
(2) calling ‘make_boxed_int’ from ‘test’
make_boxed_int
make_boxed_int: events 3-4
24 make_boxed_int (int i)
^~~~~~~~~~~~~~
|
(3) entry to ‘make_boxed_int’
25 {
26 boxed_int *result = (boxed_int *)wrapped_malloc (sizeof (boxed_int));
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
(4) calling ‘wrapped_malloc’ from ‘make_boxed_int’
wrapped_malloc
wrapped_malloc: events 5-6
8 void *wrapped_malloc (size_t size)
^~~~~~~~~~~~~~
|
(5) entry to ‘wrapped_malloc’
9 {
10 return malloc (size);
~~~~~~~~~~~~~
|
(6) allocated here
make_boxed_int: events 7-10
26 boxed_int *result = (boxed_int *)wrapped_malloc (sizeof (boxed_int));
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
(7) returning to ‘make_boxed_int’ from ‘wrapped_malloc’
27 if (!result)
~
|
(8) assuming ‘result’ is non-NULL
(9) following ‘false’ branch (when ‘result’ is non-NULL)... ─>─┐
│
│
┌────────────────────────────────────────────────────────────────────┘
28│ abort ();
29│ result->i = i;
│ ~~~~~~~~~~~~~
│ |
└───────────>(10) ...to here
test: events 11-12
41 boxed_int *obj = make_boxed_int (i);
^~~~~~~~~~~~~~~~~~
|
(11) returning to ‘test’ from ‘make_boxed_int’
42
43 free_boxed_int (obj);
~~~~~~~~~~~~~~~~~~~~
|
(12) calling ‘free_boxed_int’ from ‘test’
free_boxed_int
free_boxed_int: events 13-14
34 free_boxed_int (boxed_int *bi)
^~~~~~~~~~~~~~
|
(13) entry to ‘free_boxed_int’
35 {
36 wrapped_free (bi);
~~~~~~~~~~~~~~~~~
|
(14) calling ‘wrapped_free’ from ‘free_boxed_int’
wrapped_free
wrapped_free: events 15-16
13 void wrapped_free (void *ptr)
^~~~~~~~~~~~
|
(15) entry to ‘wrapped_free’
14 {
15 free (ptr); /* { dg-warning "double-'free' of 'ptr' \\\[CWE-415\\\]" } */
~~~~~~~~~~
|
(16) first ‘free’ here
free_boxed_int: event 17
36 wrapped_free (bi);
^~~~~~~~~~~~~~~~~
|
(17) returning to ‘free_boxed_int’ from ‘wrapped_free’
test: events 18-19
43 free_boxed_int (obj);
^~~~~~~~~~~~~~~~~~~~
|
(18) returning to ‘test’ from ‘free_boxed_int’
44
45 free_boxed_int (obj);
~~~~~~~~~~~~~~~~~~~~
|
(19) passing freed pointer ‘obj’ in call to ‘free_boxed_int’ from ‘test’
free_boxed_int
free_boxed_int: events 20-21
34 free_boxed_int (boxed_int *bi)
^~~~~~~~~~~~~~
|
(20) entry to ‘free_boxed_int’
35 {
36 wrapped_free (bi);
~~~~~~~~~~~~~~~~~
|
(21) passing freed pointer ‘bi’ in call to ‘wrapped_free’ from ‘free_boxed_int’
wrapped_free
wrapped_free: events 22-23
13 void wrapped_free (void *ptr)
^~~~~~~~~~~~
|
(22) entry to ‘wrapped_free’
14 {
15 free (ptr); /* { dg-warning "double-'free' of 'ptr' \\\[CWE-415\\\]" } */
~~~~~~~~~~
|
(23) ⚠️ second ‘free’ here; first ‘free’ was at (16)