Skip to content

Added support for calloc as allocator function for heap security rules.#3795

Open
dannytheway wants to merge 2 commits intosemgrep:developfrom
dannytheway:develop
Open

Added support for calloc as allocator function for heap security rules.#3795
dannytheway wants to merge 2 commits intosemgrep:developfrom
dannytheway:develop

Conversation

@dannytheway
Copy link
Copy Markdown

@dannytheway dannytheway commented Mar 29, 2026

Fix: use-after-free rule for the C language gives a false positive when calloc() is used as only malloc() is supported.

All rules for heap based vulnerabilities for the C language now support the calloc() instead of just malloc().
Additionally other allocator functions can be easily added to the list.

Additional Fix: Rule use-after-free didn't consider accessing memory as *var = ... vulnerable.
So a pattern to detect direct access to pointed memory was added.

Fix: Better detection of direct access to pointed memory.
@CLAassistant
Copy link
Copy Markdown

CLAassistant commented Mar 29, 2026

CLA assistant check
All committers have signed the CLA.

@CLAassistant
Copy link
Copy Markdown

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
You have signed the CLA already but the status is still pending? Let us recheck it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants