Since tracking of nested parameter objects greatly increased the amount of tracked memory objects, it also greatly increased the amount of false positives found by the CWE-416 Use After Free check. This PR implements several heuristic mitigations designed to reduce the number of false positives found by the check:
If an object gets freed in the same call as it was created, the dangling status of its pointer is not propagated to callers. A common pattern is to free freshly created objects on errors and return a null pointer instead. But the analysis cannot yet track the invariant that the pointer is only returned when it is not freed, so we have to handle this pattern heuristically.
If an object gets freed and subsequently generates a Use After Free warning in the same call then the the fact that it was freed by the call is not propagated to the caller. This should reduce duplicate CWE warnings when objects get freed on error paths.
The function signature analysis now should not generate a parameter for the first element in an array if the function loops over it. Thus the CWE-416 analysis also does not track these elements and does not generate false positive warnings if the elements of an array are freed in a loop.
Free operations for recursive data structures like linked lists are heuristically identified and ignored by the analysis. This should prevent false positives for when such a data structure gets freed using a loop.
Since tracking of nested parameter objects greatly increased the amount of tracked memory objects, it also greatly increased the amount of false positives found by the CWE-416 Use After Free check. This PR implements several heuristic mitigations designed to reduce the number of false positives found by the check:
danglingstatus of its pointer is not propagated to callers. A common pattern is to free freshly created objects on errors and return a null pointer instead. But the analysis cannot yet track the invariant that the pointer is only returned when it is not freed, so we have to handle this pattern heuristically.