<html>
    <head>
      <base href="https://llvm.org/bugs/" />
    </head>
    <body><span class="vcard"><a class="email" href="mailto:ismail.pazarbasi@gmail.com" title="Ismail Pazarbasi <ismail.pazarbasi@gmail.com>"> <span class="fn">Ismail Pazarbasi</span></a>
</span> changed
              <a class="bz_bug_link 
          bz_status_RESOLVED  bz_closed"
   title="RESOLVED INVALID - False positive in checker: Use of memory after it is freed"
   href="https://llvm.org/bugs/show_bug.cgi?id=23965">bug 23965</a>
        <br>
             <table border="1" cellspacing="0" cellpadding="8">
          <tr>
            <th>What</th>
            <th>Removed</th>
            <th>Added</th>
          </tr>

         <tr>
           <td style="text-align:right;">Status</td>
           <td>NEW
           </td>
           <td>RESOLVED
           </td>
         </tr>

         <tr>
           <td style="text-align:right;">CC</td>
           <td>
                
           </td>
           <td>ismail.pazarbasi@gmail.com
           </td>
         </tr>

         <tr>
           <td style="text-align:right;">Resolution</td>
           <td>---
           </td>
           <td>INVALID
           </td>
         </tr></table>
      <p>
        <div>
            <b><a class="bz_bug_link 
          bz_status_RESOLVED  bz_closed"
   title="RESOLVED INVALID - False positive in checker: Use of memory after it is freed"
   href="https://llvm.org/bugs/show_bug.cgi?id=23965#c3">Comment # 3</a>
              on <a class="bz_bug_link 
          bz_status_RESOLVED  bz_closed"
   title="RESOLVED INVALID - False positive in checker: Use of memory after it is freed"
   href="https://llvm.org/bugs/show_bug.cgi?id=23965">bug 23965</a>
              from <span class="vcard"><a class="email" href="mailto:ismail.pazarbasi@gmail.com" title="Ismail Pazarbasi <ismail.pazarbasi@gmail.com>"> <span class="fn">Ismail Pazarbasi</span></a>
</span></b>
        <pre>This isn't a false-positive. It's a genuine problem in the code.

<a href="https://github.com/aircrack-ng/aircrack-ng/blob/master/src/airserv-ng.c#L141">https://github.com/aircrack-ng/aircrack-ng/blob/master/src/airserv-ng.c#L141</a>
`c` is a function parameter, whose scope is limited to the function it's
declared in. Assigning NULL to it inside function scope won't change the
argument in outer scope. When `client_send_kill` returns, argument `c` that was
passed from `net_send_kill` will keep its old value, which is now-freed memory.</pre>
        </div>
      </p>
      <hr>
      <span>You are receiving this mail because:</span>
      
      <ul>
          <li>You are on the CC list for the bug.</li>
      </ul>
    </body>
</html>