Cpp: new experimental query cpp/guarded-free

[mario-campos]

This PR introduces a new experimental query that finds instances of free() guarded by a superfluous NULL check.

[github-actions]

QHelp previews:

cpp/ql/src/experimental/Best Practices/GuardedFree.qhelp

Guarded Free

The free function, which deallocates heap memory, may accept a NULL pointer and take no action. Therefore, it is unnecessary to check its argument for the value of NULL before a function call to free. As such, these guards may hinder performance and readability.

Recommendation

A function call to free should not depend upon the value of its argument. Delete the if condition preceeding a function call to free when its only purpose is to check the value of the pointer to be freed.

Example

void test()
{
    char *foo = malloc(100);

    // BAD
    if (foo)          
        free(foo);

    // GOOD
    free(foo);
}

References

• The Open Group Base Specifications Issue 7, 2018 Edition: free - free allocated memory

[MathiasVP]

LGTM!