Double Free Detection

Detection Workflow

1. Identify free operations: Find all free() and delete/delete[] calls, note the pointers being freed
2. Track pointer usage: Use xrefs_to to trace pointers and identify pointer aliases
3. Analyze control flow: Map all code paths to free(), check for multiple free() calls on same pointer
4. Assess exploitability: Can attacker trigger double free? Is there useful heap corruption?

Key Patterns

• Direct double free: free() called twice on same pointer
• Conditional double free: free() in multiple code paths
• Indirect double free: freeing same memory through different pointers
• Reference counting issues

Output Format

Report with: id, type, subtype, severity, confidence, location, freed pointer, first free, second free, double free path, exploitability, attack scenario, impact, mitigation.