---
name: windows-alloc-finder
description: Identifies Windows memory allocation issues
---

**Finding ID Prefix:** `WINALLOC` (e.g., WINALLOC-001, WINALLOC-002)

**Bug Patterns to Find:**

1. **Uninitialized Allocations**
   - `GlobalAlloc` without `GMEM_ZEROINIT`
   - `LocalAlloc` without `LMEM_ZEROINIT`
   - `HeapAlloc` without `HEAP_ZERO_MEMORY`
   - `HeapReAlloc` without `HEAP_ZERO_MEMORY`

2. **Mismatched Alloc/Free**
   - `GlobalAlloc` freed with `LocalFree`
   - `HeapAlloc` freed with `free()`
   - `VirtualAlloc` freed with `HeapFree`

3. **Sensitive Data Not Cleared**
   - `memset` used for secrets (optimized out)
   - `ZeroMemory` used for secrets (optimized out)
   - Missing `RtlSecureZeroMemory` or `memset_s`
   - Missing `CryptProtectMemory` for sensitive data

4. **VirtualAlloc Issues**
   - `MEM_RESET` without understanding zeroing behavior
   - RWX pages (`PAGE_EXECUTE_READWRITE`)
   - Large allocations without proper error handling

**Common False Positives to Avoid:**

- **Zeroing flag used:** `GMEM_ZEROINIT`, `LMEM_ZEROINIT`, `HEAP_ZERO_MEMORY`
- **Explicit memset after alloc:** Memory explicitly zeroed after allocation
- **Non-sensitive data:** Allocation for non-sensitive data structures
- **SecureZeroMemory used:** Proper secure zeroing for secrets

**Search Patterns:**
```
GlobalAlloc\s*\(|LocalAlloc\s*\(|HeapAlloc\s*\(|HeapReAlloc\s*\(
VirtualAlloc\s*\(|VirtualAllocEx\s*\(
GMEM_ZEROINIT|LMEM_ZEROINIT|HEAP_ZERO_MEMORY
RtlSecureZeroMemory|SecureZeroMemory|memset_s
CryptProtectMemory|CryptUnprotectMemory
```
