mirrors/z3
3
0
Fork 0
mirror of https://github.com/Z3Prover/z3 synced 2025-04-23 00:55:31 +00:00
Code Activity

fix a couple hundred deref-after-free bugs due to .c_str() on a temporary string

Browse source
This commit is contained in:
Nuno Lopes 2020-07-11 20:24:45 +01:00
parent 48a9defb0d
commit 23e6adcad3
64 changed files with 248 additions and 229 deletions
Download patch file Download diff file Expand all files Collapse all files

2
src/qe/qe_arrays.cpp
View file

@ -1083,7 +1083,7 @@ namespace qe {
for (expr * x : m_idxs[0].idx) {
std::stringstream name;
name << "get" << (i++);
acc.push_back(mk_accessor_decl(m, symbol(name.str().c_str()), type_ref(m.get_sort(x))));
acc.push_back(mk_accessor_decl(m, symbol(name.str()), type_ref(m.get_sort(x))));
}
constructor_decl* constrs[1] = { mk_constructor_decl(symbol("tuple"), symbol("is-tuple"), acc.size(), acc.c_ptr()) };
datatype::def* dts = mk_datatype_decl(dt, symbol("tuple"), 0, nullptr, 1, constrs);

3
src/qe/qe_datatypes.cpp
View file

@ -76,7 +76,8 @@ namespace qe {
func_decl* f = m_val->get_decl();
ptr_vector<func_decl> const& acc = *dt.get_constructor_accessors(f);
for (unsigned i = 0; i < acc.size(); ++i) {
arg = m.mk_fresh_const(acc[i]->get_name().str().c_str(), acc[i]->get_range());
auto str = acc[i]->get_name().str();
arg = m.mk_fresh_const(str.c_str(), acc[i]->get_range());
vars.push_back(arg);
model.register_decl(arg->get_decl(), m_val->get_arg(i));
args.push_back(arg);