mirrors/z3
3
0
Fork 0
mirror of https://github.com/Z3Prover/z3 synced 2025-08-14 06:45:25 +00:00
Code Activity

fix a couple hundred deref-after-free bugs due to .c_str() on a temporary string

Browse source
This commit is contained in:
Nuno Lopes 2020-07-11 20:24:45 +01:00
parent 48a9defb0d
commit 23e6adcad3
64 changed files with 248 additions and 229 deletions
Download patch file Download diff file Expand all files Collapse all files

8
src/muz/base/dl_context.cpp
View file

@ -422,7 +422,7 @@ namespace datalog {
if (!e) {
std::stringstream name_stm;
name_stm << '#' << arg_index;
return symbol(name_stm.str().c_str());
return symbol(name_stm.str());
}
SASSERT(arg_index < e->get_data().m_value.size());
return e->get_data().m_value[arg_index];
@ -1183,11 +1183,11 @@ namespace datalog {
out << " :named ";
while (fresh_names.contains(nm)) {
std::ostringstream s;
s << nm << "!";
nm = symbol(s.str().c_str());
s << nm << '!';
nm = symbol(s.str());
}
fresh_names.add(nm);
display_symbol(out, nm) << ")";
display_symbol(out, nm) << ')';
}
out << ")\n";
}

2
src/muz/base/dl_rule.cpp
View file

@ -587,7 +587,7 @@ namespace datalog {
std::stringstream _name;
_name << c;
if (j > 0) _name << j;
symbol name(_name.str().c_str());
symbol name(_name.str());
if (!us.contains(name)) {
names.push_back(name);
++i;

3
src/muz/base/hnf.cpp
View file

@ -405,7 +405,8 @@ private:
}
}
func_decl_ref f(m);
f = m.mk_fresh_func_decl(m_name.str().c_str(), "", sorts1.size(), sorts1.c_ptr(), m.mk_bool_sort());
auto str = m_name.str();
f = m.mk_fresh_func_decl(str.c_str(), "", sorts1.size(), sorts1.c_ptr(), m.mk_bool_sort());
m_fresh_predicates.push_back(f);
return app_ref(m.mk_app(f, args.size(), args.c_ptr()), m);
}