Predicate isExcludedMmFreePageFromMdl
dealloc1
is a deallocation expression, e
is an expression that dereferences a
pointer, and the (dealloc1, e)
pair should be excluded by the FlowFromFree
library.
Note that e
is not necessarily the expression deallocated by dealloc1
. It will
be bound to the second deallocation as identified by the FlowFromFree
library.
From https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/nf-wdm-mmfreepagesfrommdl: “After calling MmFreePagesFromMdl, the caller must also call ExFreePool to release the memory that was allocated for the MDL structure.”
Import path
import semmle.code.cpp.security.flowafterfree.FlowAfterFree
predicate isExcludedMmFreePageFromMdl(DeallocationExpr dealloc1, Expr e)