CodeQL library for C/C++
codeql/cpp-all 2.1.1-dev (changelog, source)
Search

Predicate isExcludedMmFreePageFromMdl

dealloc1 is a deallocation expression, e is an expression that dereferences a pointer, and the (dealloc1, e) pair should be excluded by the FlowFromFree library.

Note that e is not necessarily the expression deallocated by dealloc1. It will be bound to the second deallocation as identified by the FlowFromFree library.

From https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/nf-wdm-mmfreepagesfrommdl: “After calling MmFreePagesFromMdl, the caller must also call ExFreePool to release the memory that was allocated for the MDL structure.”

Import path

import semmle.code.cpp.security.flowafterfree.FlowAfterFree
predicate isExcludedMmFreePageFromMdl(DeallocationExpr dealloc1, Expr e)