mirrors/z3
3
0
Fork 0
mirror of https://github.com/Z3Prover/z3 synced 2025-10-03 22:43:56 +00:00
Code Activity

fix a couple hundred deref-after-free bugs due to .c_str() on a temporary string

Browse source
This commit is contained in:
Nuno Lopes 2020-07-11 20:24:45 +01:00
parent 48a9defb0d
commit 23e6adcad3
64 changed files with 248 additions and 229 deletions
Download patch file Download diff file Expand all files Collapse all files

21
src/opt/opt_context.cpp
View file

@ -665,9 +665,8 @@ namespace opt {
opt_params p(m_params);
if (p.optsmt_engine() == symbol("symba") ||
p.optsmt_engine() == symbol("farkas")) {
std::stringstream strm;
strm << AS_OPTINF;
gparams::set("smt.arith.solver", strm.str().c_str());
auto str = std::to_string(AS_OPTINF);
gparams::set("smt.arith.solver", str.c_str());
}
}
@ -693,7 +692,7 @@ namespace opt {
expr_ref_vector fmls(m);
get_solver().get_assertions(fmls);
m_sat_solver->assert_expr(fmls);
m_solver = m_sat_solver.get();
m_solver = m_sat_solver.get();
}
void context::enable_sls(bool force) {
@ -950,8 +949,8 @@ namespace opt {
tout << "offset: " << offset << "\n";
);
std::ostringstream out;
out << orig_term << ":" << index;
id = symbol(out.str().c_str());
out << orig_term << ':' << index;
id = symbol(out.str());
return true;
}
if (is_max && get_pb_sum(term, terms, weights, offset)) {
@ -973,8 +972,8 @@ namespace opt {
}
neg = true;
std::ostringstream out;
out << orig_term << ":" << index;
id = symbol(out.str().c_str());
out << orig_term << ':' << index;
id = symbol(out.str());
return true;
}
if ((is_max || is_min) && m_bv.is_bv(term)) {
@ -992,9 +991,9 @@ namespace opt {
}
neg = is_max;
std::ostringstream out;
out << orig_term << ":" << index;
id = symbol(out.str().c_str());
return true;
out << orig_term << ':' << index;
id = symbol(out.str());
return true;
}
return false;
}