mirrors/z3
3
0
Fork 0
mirror of https://github.com/Z3Prover/z3 synced 2025-08-28 14:08:55 +00:00
Code Activity

fix a couple hundred deref-after-free bugs due to .c_str() on a temporary string

Browse source
This commit is contained in:
Nuno Lopes 2020-07-11 20:24:45 +01:00
parent 48a9defb0d
commit 23e6adcad3
64 changed files with 248 additions and 229 deletions
Download patch file Download diff file Expand all files Collapse all files

2
src/muz/transforms/dl_mk_rule_inliner.cpp
View file

@ -116,7 +116,7 @@ namespace datalog {
SASSERT(tail.size()==tail_neg.size());
std::ostringstream comb_name;
comb_name << tgt.name().str() << ";" << src.name().str();
symbol combined_rule_name = symbol(comb_name.str().c_str());
symbol combined_rule_name(comb_name.str());
res = m_rm.mk(new_head, tail.size(), tail.c_ptr(), tail_neg.c_ptr(), combined_rule_name, m_normalize);
res->set_accounting_parent_object(m_context, const_cast<rule*>(&tgt));
TRACE("dl",

2
src/muz/transforms/dl_mk_unbound_compressor.cpp
View file

@ -71,7 +71,7 @@ namespace datalog {
std::stringstream name_suffix;
name_suffix << "compr_arg_" << arg_index;
func_decl * cpred = m_context.mk_fresh_head_predicate(parent_name, symbol(name_suffix.str().c_str()),
func_decl * cpred = m_context.mk_fresh_head_predicate(parent_name, symbol(name_suffix.str()),
arity, domain.c_ptr(), pred);
m_pinned.push_back(cpred);
m_pinned.push_back(pred);