## Use After Free (Critical)

### Trigger Signals

- Continued use of pointer/reference after `free`/`delete`/`drop`/`Box::from_raw`
- Function returning pointer or reference to local variable (`return &local_var`, `return local_array`)
- Iterator invalidation (deleting/modifying container elements in a for loop, continuing to use iterator)
- Smart pointer `reset()`/`release()` followed by use of the original raw pointer
- Use of moved object after `std::move`

### Judgment Process

1. **Identify free points**: `Read` extracts all `free`/`delete`/`drop`/`reset`/`release` calls, marking the freed pointers/references
2. **Track post-free use**: For each free point, `Read` checks whether subsequent code still:
   - Dereferences the pointer (`*ptr`, `ptr->field`)
   - Passes the pointer to other functions
   - Compares with other pointers (`if (ptr == other)`)
3. **Check function return values**: `Read` checks whether return statements return addresses or references of local variables
4. **Check iterator invalidation**: `Read` checks whether there are container modifications (insert/erase/remove) within loop bodies, and whether iterators are still used after modification

### Evidence Construction

After confirming a defect, the output must include:
- Free point (location of the free operation, with file:line number)
- Use point (illegal access location after free)
- Distance from free to use (whether in the same thread/function, dangling time window)
- Security impact (data leakage, crash, arbitrary code execution -- depending on whether freed memory is reused)

### Exclusions

- Pointer set to null after free (`ptr = nullptr`) with subsequent null check
- Using RAII/smart pointers (`unique_ptr`/`shared_ptr`/`Box`) with lifetime managed by compiler
- Rust safe code (guaranteed by borrow checker)
- No access to moved object after `std::move` (compiler can detect in some scenarios)
