<table border="1" cellspacing="0" cellpadding="8">
    <tr>
        <th>Issue</th>
        <td>
            <a href=https://github.com/llvm/llvm-project/issues/81597>81597</a>
        </td>
    </tr>

    <tr>
        <th>Summary</th>
        <td>
            false positive: `Argument to free() is the address of ..., which is not memory allocated by malloc()`
        </td>
    </tr>

    <tr>
      <th>Labels</th>
      <td>
            new issue
      </td>
    </tr>

    <tr>
      <th>Assignees</th>
      <td>
      </td>
    </tr>

    <tr>
      <th>Reporter</th>
      <td>
          phlax
      </td>
    </tr>
</table>

<pre>
    we are seeing the above error in our CI (running clang-tidy on the https://github.com/envoyproxy/envoy project)

it would appear this is a false positive that should not trigger on a member function

full log:

```console
/b/f/w/source/common/stats/symbol_table.cc:623:3: error: Argument to free() is the address of a local stack variable, which is not memory allocated by malloc() [clang-analyzer-unix.Malloc,-warnings-as-errors]
 table.free(statName());
 ^
/b/f/w/source/common/stats/symbol_table.cc:629:5: note: Calling 'StatNameStorage::free'
    storage.free(symbol_table_);
 ^~~~~~~~~~~~~~~~~~~~~~~~~~~
/b/f/w/source/common/stats/symbol_table.cc:623:3: note: Argument to free() is the address of a local stack variable, which is not memory allocated by malloc()
  table.free(statName());
  ^ ~~~~~~~~~~
/b/f/w/source/common/stats/symbol_table.cc:736:5: error: Argument to free() is the address of the parameter 'stat_name', which is not memory allocated by malloc() [clang-analyzer-unix.Malloc,-warnings-as-errors]
 symbol_table.free(stat_name);
 ^
/b/f/w/source/common/stats/symbol_table.cc:735:3: note: Calling 'StatNameList::iterate'
  iterate([&symbol_table](StatName stat_name) -> bool {
 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/b/f/w/source/common/stats/symbol_table.cc:725:24: note: Assuming 'i' is < 'num_elements'
  for (uint32_t i = 0; i < num_elements; ++i) {
 ^~~~~~~~~~~~~~~~
/b/f/w/source/common/stats/symbol_table.cc:725:3: note: Loop condition is true.  Entering loop body
  for (uint32_t i = 0; i < num_elements; ++i) {
  ^
 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/b/f/w/source/common/stats/symbol_table.cc:736:5: note: Argument to free() is the address of the parameter 'stat_name', which is not memory allocated by malloc()
    symbol_table.free(stat_name);
 ^                 ~~~~~~~~~
```
</pre>
<img width="1px" height="1px" alt="" src="http://email.email.llvm.org/o/eJy8VlGPozYQ_jXOyygRGS8BHnhIshep0rUv9wNWBgZwa-zINptNH_rbqyFkL7tqT7tVeogEbMb2fN83Y48KQXeWqBTpTqSPCzXG3vny2Bv1sqhccy5PBMoTBCJtO4g9garcMwF57zxoC270sP8FBOZ-tJaNaqNst4y6OYOz05A-xmMQcivwIPDQ6diP1ap2g8AD2Wd3Pnr3cr424Ojd71RHgYVIHkWyvfzrCCc3mgbU8UjKQ-x1AB1AQatMIDi6oKN-Joi9ihD6yda6CNHrriPPvigYaKjIQzvaOmpnbxdoR2PAuI79vOkWm-Ry184GZ2juxUMl8NAKPJwEHoIbfU0CD7UbBme5J6oY-HkeKmeeoqoMrepayO0GpZBb_l1I5Jet78aBbITooPVEAnOBBcObGG8aTyGAa0GBcbUyEKKq_4Bn5TVPLHAPp17XPY9gzAMNzp9BGbaO1EB1hmFqzTOLdHeRSVllzn-SX45Wv6x-nW32y5PyLGZYqrCc3AwifbxghwuY2U8G-psaZpf5lrvZTqRf7sBWIeQ2ZZKsi8TPvTKG40xg9m1e_Ft0XnX8VcjtxbFsdgIAwuXrq8c3izy9d_ivf73uKfwVys_W_crJRxVkRuCOFGRyc1Xz87HPzaPyaqBIntXndZ7s5Hn2k1PgDbQbHmd37pwEmUzfR84_JMFXHeIlA3Qkr-JtErz25LzT4-Z2DUaF-XUWuIUBSyG_QOWcAZF9KEv-x_zJkFnAhzcJFMI4zDxogRmrL-Sem3YcnsgQh1a4YaJ1HDv5qG2U-BRBg5CPkAi5m1738Gac3IHAncCdnkLmBxzcCd4bkb86d4Ta2UbzYTWlhB9pBfDFRvIM27AFH9T3hfc9av-r2nfdKz69Xd53q7g5ST6T9vD-es_NtbJYNKVsClmoBZXrLMly3KxlvuhLahPEFmtVpEqlsqnXtcxUjkXRrKXEYqFLTPAhwbVcY5Kn-YotmybFuqqx3rSNeEhoUNqsjHkeVs53Cx3CSGW-TotsYVRFJkzFH6KlE0wfBSLXgr7kMctq7IJ4SIwOMXyfJepoqHxbebFCYpN8WKTVavV5KTbJYvSm_EFFyT7Oj-VrKXmYkHGgTcj_DgAA__-LLYqI">