mirrors/z3
3
0
Fork 0
mirror of https://github.com/Z3Prover/z3 synced 2025-04-24 01:25:31 +00:00
Code Activity

fix a couple hundred deref-after-free bugs due to .c_str() on a temporary string

Browse source
This commit is contained in:
Nuno Lopes 2020-07-11 20:24:45 +01:00
parent 48a9defb0d
commit 23e6adcad3
64 changed files with 248 additions and 229 deletions
Download patch file Download diff file Expand all files Collapse all files

2
src/sat/sat_drat.cpp
View file

@ -38,7 +38,7 @@ namespace sat {
{
if (s.get_config().m_drat && s.get_config().m_drat_file != symbol()) {
auto mode = s.get_config().m_drat_binary ? (std::ios_base::binary | std::ios_base::out | std::ios_base::trunc) : std::ios_base::out;
m_out = alloc(std::ofstream, s.get_config().m_drat_file.str().c_str(), mode);
m_out = alloc(std::ofstream, s.get_config().m_drat_file.str(), mode);
if (s.get_config().m_drat_binary) {
std::swap(m_out, m_bout);
}

9
src/sat/sat_solver/inc_sat_solver.cpp
View file

@ -206,8 +206,7 @@ public:
catch (z3_exception& ex) {
IF_VERBOSE(10, verbose_stream() << "exception: " << ex.msg() << "\n";);
reason_set = true;
std::string msg = std::string("(sat.giveup ") + ex.msg() + std::string(")");
set_reason_unknown(msg.c_str());
set_reason_unknown(std::string("(sat.giveup ") + ex.msg() + ')');
r = l_undef;
}
switch (r) {
@ -500,6 +499,10 @@ public:
m_unknown = msg;
}
void set_reason_unknown(std::string &&msg) {
m_unknown = std::move(msg);
}
void get_labels(svector<symbol> & r) override {
}
@ -656,7 +659,7 @@ private:
strm << "(sat.giveup interpreted atoms sent to SAT solver " << atoms <<")";
TRACE("sat", tout << strm.str() << "\n";);
IF_VERBOSE(1, verbose_stream() << strm.str() << "\n";);
set_reason_unknown(strm.str().c_str());
set_reason_unknown(strm.str());
return l_undef;
}
return l_true;