The MemoryMayNotBeFreed.ql query normally considers a realloc to be both an alloc, and a free of the old pointer. A subtlety is that if realloc fails and returns NULL it does not free the old pointer. To account for this the query considers the free of the old pointer to occur only if and when the return value is checked:

ptr_b = realloc(ptr_a, new_size);
if (ptr_b == 0)
{
  // handle failure (perhaps with an explicit free(ptr_a))
} else {
  // the realloc is considered to free ptr_a here
}

This works well up until we assign to the same variable:

ptr_a = realloc(ptr_a, new_size);
if (ptr_a == 0)
{
  // handle failure (which might be a bit awkward since we've just overwritten ptr_a)
} else {
  // the realloc is considered to free ptr_a here
}

Because now we get confused by the old vs new ptr_a and think the new allocation is being freed.

The ideal solution is probably to upgrade this query to use something like DataFlow rather than LocalScopeVariableReachability (I've created a JIRA ticket for this).

However, we need a quick fix because it's causing a regression on version 1.3 of the samate test-suite compared to the results we had on version 1.2. The workaround is not to consider this particular pattern on realloc as to be a free at all.