Example - 1

The following code shows a simple example of a use after free error:

abrt = 1;free(ptr);
logError("operation aborted before commit", ptr);char* ptr = (char*)malloc (SIZE);if (err) {}...if (abrt) {}

When an error occurs, the pointer is immediately freed. However, this pointer is later incorrectly used in the logError function.

Example - 2

The following code shows a simple example of a double free error:

free(ptr);
char* ptr = (char*)malloc (SIZE);...if (abrt) {}...free(ptr);

Double free vulnerabilities have two common (and sometimes overlapping) causes:

Error conditions and other exceptional circumstancesConfusion over which part of the program is responsible for freeing the memory

Although some double free vulnerabilities are not much more complicated than the previous example, most are spread out across hundreds of lines of code or even different files. Programmers seem particularly susceptible to freeing global variables more than once.