Memory Leaks Detected Using Code Sanitizer

R2026b

When you enable memory leak detection in the code sanitizer, Polyspace® Test™ instruments memory allocation and deallocation operations in your code. During test execution, the sanitizer tracks every dynamically allocated block of memory and reports a MEM_LEAK defect when allocated memory becomes unreachable without being freed.

The sanitizer detects memory leaks caused by various control flow patterns. The following sections describe each type of leak with code examples.

Memory Lost When Function Returns

A memory leak occurs when a function allocates memory but does not free it before returning. The pointer to the allocated memory is lost when the function's local variables go out of scope.

void process_data() {
    int *p = (int *)malloc(sizeof(int) * 10);
    // Use p...
    // Function returns without calling free(p)
    // Memory is leaked
}

This pattern applies to memory allocated with malloc, calloc, realloc, strdup, new, or new[].

Memory Lost When Scope Ends

A memory leak occurs when a pointer to allocated memory is declared inside a block (such as an if statement or loop body) and the block ends without freeing the memory. The pointer goes out of scope at the end of the block.

void process_conditionally() {
    if (some_condition()) {
        char *buffer = (char *)malloc(100);
        // Use buffer...
        // Scope ends here, 'buffer' is lost
    }
    // buffer pointer no longer accessible, memory is leaked
}

Memory Lost After Jump to Another Scope

A memory leak occurs when a goto statement transfers control past the point where allocated memory would have been freed.

void process_with_goto() {
    char *data = (char *)malloc(50);

    if (error_condition()) {
        goto cleanup;  // Jump bypasses free(data)
    }

    free(data);
    return;

cleanup:
    // data pointer is not freed here
    return;
}

Memory Lost in Next Loop Iteration

A memory leak occurs when a continue statement causes control to jump to the next loop iteration, skipping the code that frees the memory allocated in the current iteration.

void process_in_loop() {
    for (int i = 0; i < 10; i++) {
        int *temp = (int *)malloc(sizeof(int));

        if (i % 2 == 0) {
            continue;  // Skip to next iteration, temp is not freed
        }

        free(temp);
    }
}

Memory Lost When Breaking from Loop

A memory leak occurs when a break statement exits a loop without freeing memory that was allocated inside the loop body.

void process_until_done() {
    while (keep_running()) {
        void *resource = malloc(256);

        if (should_exit()) {
            break;  // Exit loop without freeing resource
        }

        free(resource);
    }
}

Memory Lost When Containing Object Is Freed

A memory leak occurs when a structure or object that contains pointers to dynamically allocated memory is freed or destroyed without first freeing the nested allocations.

typedef struct {
    int value;
    char *nested_ptr;
} MyStruct;

void process_struct() {
    MyStruct *root = (MyStruct *)malloc(sizeof(MyStruct));
    root->nested_ptr = (char *)malloc(100);  // Nested allocation

    free(root);  // Root freed, but nested_ptr not freed first
}

Memory Lost After Pointer Reassignment

A memory leak occurs when a pointer that holds a reference to allocated memory is overwritten with a new value (such as a new allocation or NULL) without first freeing the original memory.

void process_multiple() {
    char *ptr = (char *)malloc(100);

    // First allocation is lost when ptr is reassigned
    ptr = (char *)malloc(200);

    free(ptr);  // Only frees the second allocation
}

Memory Lost When Return Value Is Ignored

A memory leak occurs when a function that returns a pointer to dynamically allocated memory is called but the return value is not captured. The allocated memory becomes immediately unreachable.

char *allocate_buffer() {
    return (char *)malloc(512);
}

void process_without_capture() {
    allocate_buffer();  // Return value ignored, memory is leaked

    (void)malloc(256);  // Explicitly discarded, memory is leaked
}

See Also

Topics