CPP: Fix some use after free FPs.

cpp/ql/src/Critical/UseAfterFree.ql

@@ -31,7 +31,7 @@ private predicate externalCallNeverDereferences(FormattingFunctionCall call, int
 
 predicate isUse0(DataFlow::Node n, Expr e) {
   e = n.asExpr() and
-  not isFree(_, e, _) and
+  not isFree(n, _, _) and
   (
     e = any(PointerDereferenceExpr pde).getOperand()
     or
@@ -43,7 +43,7 @@ predicate isUse0(DataFlow::Node n, Expr e) {
     or
     // Assume any function without a body will dereference the pointer
     exists(int i, Call call, Function f |
-      n.asExpr() = call.getArgument(i) and
+      e = call.getArgument(i) and
       f = call.getTarget() and
       not f.hasEntryPoint() and
       // Exclude known functions we know won't dereference the pointer.

cpp/ql/test/query-tests/Critical/MemoryFreed/MemoryFreed.expected

@@ -26,6 +26,7 @@
 | test.cpp:128:15:128:16 | v4 |
 | test.cpp:185:10:185:12 | cpy |
 | test.cpp:199:10:199:12 | cpy |
+| test.cpp:205:7:205:11 | ... = ... |
 | test_free.cpp:11:10:11:10 | a |
 | test_free.cpp:14:10:14:10 | a |
 | test_free.cpp:16:10:16:10 | a |

cpp/ql/test/query-tests/Critical/MemoryFreed/MemoryMayNotBeFreed.expected

@@ -1 +1,2 @@
+| test.cpp:203:12:203:17 | call to malloc | This memory allocation may not be released at $@. | test.cpp:206:1:206:1 | return ... | this exit point |
 | test_free.cpp:36:22:36:35 | ... = ... | This memory allocation may not be released at $@. | test_free.cpp:38:1:38:1 | return ... | this exit point |

cpp/ql/test/query-tests/Critical/MemoryFreed/test.cpp

@@ -198,3 +198,9 @@ void test_strndupa_dealloc() {
 	char *cpy = strndupa(msg, 4);
     free(cpy); // BAD [NOT DETECTED]
 }
+
+void test_free_malloc() {
+	void *a = malloc(10);
+	void *b;
+	free(b = a);
+}