This warning flags places where malloc or free is invoked explicitly in accordance to R.10: Avoid malloc and free. One potential fix for such warnings would be to use std::make_unique to avoid explicit creation and destruction of objects. If such a fix is not acceptable, operator new and delete should be preferred. In some cases, if exceptions are not welcome, malloc and free can be replaced with the nothrow version of operators new and delete.

• To detect malloc() we check if a call invokes a global function with name "malloc" or "std::malloc". The function must return a pointer to void and accept one parameter of unsigned integral type.

• To detect free() we check global functions with names "free" or "std::free" which return no result and accept one parameter, which is a pointer to void.

C++ Core Guidelines R.10

#include <new>

struct myStruct {};

void function_malloc_free() {
    myStruct* ms = static_cast<myStruct*>(malloc(sizeof(myStruct))); // C26408
    free(ms); // C26408
}

void function_nothrow_new_delete() {
    myStruct* ms = new(std::nothrow) myStruct;
    operator delete (ms, std::nothrow);
}