mcp-server-semgrep/semgrep-rules/c/lang/security/function-use-after-free.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
  - id: function-use-after-free
    patterns:
      - pattern-either:
        - pattern: $FUNC(..., <... $VAR ...>, ...)
        - pattern: $FUNC(..., <... $VAR->$ACCESSOR ...>, ...)
        - pattern: $FUNC(..., <... (*$VAR).$ACCESSOR ...>, ...)
        - pattern: $FUNC(..., <... $VAR[$NUM] ...>, ...)
      - metavariable-regex:
          metavariable: $FUNC
          regex: (?!^free$)
      - pattern-inside:
          free($VAR);
          ...
      - pattern-not-inside:
          free($VAR);
          ...
          $VAR = NULL;
          ...
      - pattern-not-inside:
          free($VAR);
          ...
          $VAR = malloc(...);
          ...
    message: Variable '$VAR' was passed to a function after being freed. This can lead to undefined behavior.
    metadata:
      cwe:
        - "CWE-416: Use After Free"
      references:
        - https://cwe.mitre.org/data/definitions/416.html
        - https://ctf-wiki.github.io/ctf-wiki/pwn/linux/glibc-heap/use_after_free/
      category: security
      technology:
        - c
      confidence: LOW
      cwe2022-top25: true
      cwe2021-top25: true
      subcategory:
        - vuln
      likelihood: LOW
      impact: HIGH
    languages:
      - c
    severity: WARNING