Skip to content

Account for frees in undefined functions - #2269

Closed
jprotopopov-ut wants to merge 4 commits into
masterfrom
issue_2268
Closed

jprotopopov-ut wants to merge 4 commits into
masterfrom
issue_2268

Conversation

@jprotopopov-ut

Copy link
Copy Markdown
Contributor

Addresses #2268, implementing accounting for frees in undefined functions, which produces warnings such as lval ((alloc@sid:18@tid:[main])) points to a maybe freed memory region.
The changeset is AI-generated, extracted from the effects implementation. No validation has been done beyond the reproducer from the linked issue.

Creating as a draft because of dependencies on other PRs; the draft includes some of the content from these PRs.

jprotopopov-ut and others added 4 commits October 23, 2026 14:58
Track local storage whose function activation has ended and diagnose
subsequent accesses through retained pointers. Cover automatic-storage
lifetimes in regression tests.

Assisted-by: Codex <noreply@openai.com>
A free through an unknown address may invalidate a named heap object, and an unknown access may reach an already invalid object. Preserve this evidence locally and across threads instead of ignoring the unknown target.

Co-authored-by: Jevgenijs Protopopovs <jevgenijs.protopopovs@ut.ee>
Assisted-by: Claude <noreply@anthropic.com>
Assisted-by: Codex <noreply@openai.com>
Describe implicit standard-stream accesses, including fortified and
unlocked entry points, fflush(NULL), and Darwin names. Model accesses to
buffers held by streams and add portable regression coverage.

Assisted-by: Claude <noreply@anthropic.com>
Assisted-by: Codex <noreply@openai.com>
An unspecified function may free heap objects reachable through arguments, globals or previously retained addresses. Track those roots across calls and threads, including aggregate arguments and unknown-address stores.

Co-authored-by: Jevgenijs Protopopovs <jevgenijs.protopopovs@ut.ee>
Assisted-by: Claude <noreply@anthropic.com>
Assisted-by: Codex <noreply@openai.com>
@sim642 sim642 added bug AI AI-found/generated labels Oct 23, 2026
@sim642 sim642 added the pr-dependency Depends or builds on another PR, which should be merged before label Oct 23, 2026
@sim642 sim642 closed this Oct 23, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

AI AI-found/generated bug pr-dependency Depends or builds on another PR, which should be merged before

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Missing use-after-free warnings due to not accounting for behavior of functions with no definition

3 participants