mirrors/z3
3
0
Fork 0
mirror of https://github.com/Z3Prover/z3 synced 2025-04-27 19:05:51 +00:00
Code Activity

fix a couple hundred deref-after-free bugs due to .c_str() on a temporary string

Browse source
This commit is contained in:
Nuno Lopes 2020-07-11 20:24:45 +01:00
parent 48a9defb0d
commit 23e6adcad3
64 changed files with 248 additions and 229 deletions
Download patch file Download diff file Expand all files Collapse all files

10
src/muz/rel/check_relation.cpp
View file

@ -280,7 +280,7 @@ namespace datalog {
std::ostringstream strm;
strm << "x" << j;
bound.push_back(sig[i]);
names.push_back(symbol(strm.str().c_str()));
names.push_back(symbol(strm.str()));
vars.push_back(m.mk_var(j, sig[i]));
++j;
}
@ -400,8 +400,8 @@ namespace datalog {
var_subst sub(m, false);
for (unsigned i = 0; i < sig.size(); ++i) {
std::stringstream strm;
strm << "x" << i;
vars.push_back(m.mk_const(symbol(strm.str().c_str()), sig[i]));
strm << 'x' << i;
vars.push_back(m.mk_const(symbol(strm.str()), sig[i]));
}
fml1 = sub(fml1, vars.size(), vars.c_ptr());
fml2 = sub(fml2, vars.size(), vars.c_ptr());
@ -448,8 +448,8 @@ namespace datalog {
var_subst sub(m, false);
for (unsigned i = 0; i < sig.size(); ++i) {
std::stringstream strm;
strm << "x" << i;
vars.push_back(m.mk_const(symbol(strm.str().c_str()), sig[i]));
strm << 'x' << i;
vars.push_back(m.mk_const(symbol(strm.str()), sig[i]));
}
fml1 = sub(fml1, vars.size(), vars.c_ptr());
fml2 = sub(fml2, vars.size(), vars.c_ptr());

3
src/muz/rel/dl_base.cpp
View file

@ -373,7 +373,8 @@ namespace datalog {
std::ostringstream buffer;
buffer << "creating large table of size " << upper_bound;
if (p) buffer << " for relation " << p->get_name();
warning_msg("%s", buffer.str().c_str());
auto str = buffer.str();
warning_msg("%s", str.c_str());
}
for (table_element i = 0; i < upper_bound; i++) {

2
src/muz/rel/dl_lazy_table.cpp
View file

@ -29,7 +29,7 @@ namespace datalog {
symbol lazy_table_plugin::mk_name(table_plugin& p) {
std::ostringstream strm;
strm << "lazy_" << p.get_name();
return symbol(strm.str().c_str());
return symbol(strm.str());
}
table_base * lazy_table_plugin::mk_empty(const table_signature & s) {