On Tue, 12 Nov 2013, Ondřej Bílka wrote:
Anyway you need a better analysis to determine if user called realloc on converted pointer.
Note that I am checking if the argument of free is the same as the return value of malloc by looking at the SSA_NAME, not the C variable. If the user called realloc on this value and then calls free on the same value on all paths (including those where realloc returned a different value), that's a broken program to start with. But indeed my current patch fails on:
p=malloc(12); q=realloc(p,16); if(p==q)free(p); exit(0); because I (wrongly apparently) considered exit as safe as free :-( -- Marc Glisse
