mirrors/z3
3
0
Fork 0
mirror of https://github.com/Z3Prover/z3 synced 2025-04-24 01:25:31 +00:00
Code Activity

fix a couple hundred deref-after-free bugs due to .c_str() on a temporary string

Browse source
This commit is contained in:
Nuno Lopes 2020-07-11 20:24:45 +01:00
parent 48a9defb0d
commit 23e6adcad3
64 changed files with 248 additions and 229 deletions
Download patch file Download diff file Expand all files Collapse all files

2
src/model/model2expr.cpp
View file

@ -52,7 +52,7 @@ symbol mk_fresh_name::next() {
_name << m_char;
if (m_num > 0) _name << m_num;
++m_char;
symbol name(_name.str().c_str());
symbol name(_name.str());
if (!m_symbols.contains(name)) {
return name;
}

6
src/model/model_smt2_pp.cpp
View file

@ -107,7 +107,7 @@ static void pp_uninterp_sorts(std::ostream & out, ast_printer_context & ctx, mod
cname = mk_smt2_quoted_symbol(csym);
else
cname = csym.str();
format * c_args[2] = { var, mk_string(m, cname.c_str()) };
format * c_args[2] = { var, mk_string(m, cname) };
f_conds.push_back(mk_seq1<format**, f2f>(m, c_args, c_args+2, f2f(), "="));
}
SASSERT(!f_conds.empty());
@ -210,7 +210,7 @@ static void pp_funs(std::ostream & out, ast_printer_context & ctx, model_core co
for (unsigned j = 0; j < f->get_arity(); j++) {
std::stringstream strm;
strm << "x!" << (j+1);
var_names.push_back(symbol(strm.str().c_str()));
var_names.push_back(symbol(strm.str()));
}
}
else {
@ -274,7 +274,7 @@ static void pp_funs(std::ostream & out, ast_printer_context & ctx, model_core co
def = mk_indent(m, indent, mk_compose(m,
mk_compose(m,
mk_string(m, "(define-fun "),
mk_string(m, fname.c_str()),
mk_string(m, fname),
mk_string(m, " "),
mk_compose(m,
f_domain,

2
src/model/seq_factory.h
View file

@ -97,7 +97,7 @@ public:
while (true) {
std::ostringstream strm;
strm << m_unique_delim << std::hex << m_next++ << std::dec << m_unique_delim;
symbol sym(strm.str().c_str());
symbol sym(strm.str());
if (m_strings.contains(sym)) continue;
m_strings.insert(sym);
return u.str.mk_string(sym);