Static analyzer (double-free): false positive for loops

Static analyzer (double-free): false positive for loops

[Pierrick Philippe]

[-- Attachment #1: Type: text/plain, Size: 698 bytes --]

Hi all,

I was playing around with the static analyzer and get a false positive.
I am using gcc build locally from commit tagged as /basepoints///13/ 
(sha: /091e10203846812c4e98b465ddfb36d12f146be8/).
Here is the code:

'''
1 │ #include <stdlib.h>
2 │
3 │ int main(void) {
4 │     int * ptr = (int *)malloc(sizeof(int));
5 │     for(int i = 0; i < 10; i++) {
6 │         if (i == 5) free(ptr);
7 │     }
8 │ }
'''

This snippet is falsely reported as a double_free due to call to free() 
on line 6.
I am pretty sure this is a known issue, but I am more interested in the 
why here.
Is this due to how loops are handled in the static analyzer?

Thanks,
Pierrick