mirrors/z3
3
0
Fork 0
mirror of https://github.com/Z3Prover/z3 synced 2025-08-10 13:10:50 +00:00
Code Activity

fix a couple hundred deref-after-free bugs due to .c_str() on a temporary string

Browse source
This commit is contained in:
Nuno Lopes 2020-07-11 20:24:45 +01:00
parent 48a9defb0d
commit 23e6adcad3
64 changed files with 248 additions and 229 deletions
Download patch file Download diff file Expand all files Collapse all files

7
src/parsers/smt2/smt2parser.cpp
View file

@ -836,7 +836,7 @@ namespace smt2 {
symbol ct_name = curr_id();
std::string r_str = "is-";
r_str += curr_id().str();
symbol r_name(r_str.c_str());
symbol r_name(r_str);
next();
TRACE("datatype_parser_bug", tout << ct_name << " " << r_name << "\n";);
ct_decls.push_back(pm().mk_pconstructor_decl(m_sort_id2param_idx.size(), ct_name, r_name, 0, nullptr));
@ -847,7 +847,7 @@ namespace smt2 {
symbol ct_name = curr_id();
std::string r_str = "is-";
r_str += curr_id().str();
symbol r_name(r_str.c_str());
symbol r_name(r_str);
next();
paccessor_decl_ref_buffer new_a_decls(pm());
parse_accessor_decls(new_a_decls);
@ -1148,7 +1148,8 @@ namespace smt2 {
else {
std::ostringstream str;
str << "unknown attribute " << id;
warning_msg("%s", str.str().c_str());
auto msg = str.str();
warning_msg("%s", msg.c_str());
next();
// just consume the
consume_sexpr();