False positives in cpp/user-after-free

`cpp-user-after-free` seems to have a number of false positives, particular when a pointer is `free`d, re-allocated, and then reused correctly.

Consider the following code snippet from [this part](https://github.com/OpenSC/OpenSC/blob/master/src/libopensc/card-piv.c#L2939) of [OpenSC](https://github.com/OpenSC/OpenSC):

```c
free(priv->aid_der.value); /* free previous value if any */
if ((priv->aid_der.value = malloc(resplen)) == NULL) {
LOG_FUNC_RETURN(card->ctx, SC_ERROR_OUT_OF_MEMORY);
}
memcpy(priv->aid_der.value, rbuf, resplen);
priv->aid_der.len = resplen;
LOG_FUNC_RETURN(card->ctx,i);
```

Analysis of the code shows that although free(priv->aid_der.value) is called at line 2939, the pointer priv->aid_der.value is immediately reassigned by a malloc call at line 2940. If the malloc fails, the function returns before the potentially dangerous memcpy at line 2943 is reached. If malloc succeeds, the memcpy operates on the newly allocated buffer, preventing a use-after-free. This finding appears to be a false positive.

Similarly, consider this snippet from [this part](https://github.com/assimp/assimp/blob/master/code/AssetLib/ASE/ASELoader.cpp#L661) of [Assimp](https://github.com/assimp/assimp):

```cpp
delete[] pcScene->mRootNode->mChildren;
for (std::vector::/*const_*/ iterator i = aiList.begin(); i != aiList.end(); ++i) {
const ASE::BaseNode *src = *i;

// The parent is not known, so we can assume that we must add
// this node to the root node of the whole scene
aiNode *pcNode = new aiNode();
pcNode->mParent = pcScene->mRootNode;
pcNode->mName.Set(src->mName);
AddMeshes(src, pcNode);
AddNodes(nodes, pcNode, pcNode->mName.data);
apcNodes.push_back(pcNode);
}

// Regenerate our output array
pcScene->mRootNode->mChildren = new aiNode *[apcNodes.size()];
for (unsigned int i = 0; i < apcNodes.size(); ++i)
pcScene->mRootNode->mChildren[i] = apcNodes[i];

pcScene->mRootNode->mNumChildren = (unsigned int)apcNodes.size();
}
```

Again, the CodeQL finding indicates a potential use-after-free vulnerability where pcScene->mRootNode->mChildren is deleted at line 661 and potentially used later at line 678. Analysis of the code shows that pcScene->mRootNode->mChildren is reallocated with new aiNode*[apcNodes.size()] on line 678 before being accessed in the loop starting on line 679. Therefore, this finding appears to be a false positive, as the memory is valid when accessed.

These findings were generated when running `codeql/cpp-queries` against the given codebases.

## Recommendation

Revise the query to look for use of a `free`d pointer where the the use of the pointer is done before any `malloc`, `new` or similar memory-allocating function is performed. Validate the query against test cases such as these to ensure that proper pointer re-use isn't flagged as a potential UAF.

從 codeql/cpp-queries 中的 cpp/user-after-free 查詢開始，並重現 issue 中的 C 和 C++ 範例。為 free-then-malloc 和 delete-then-new 後的指標重用新增驗證案例，並確認該查詢不會回報替換配置後的使用，同時仍能識別重新配置前的真實使用。

由索引模型根據 Issue 內容生成。