Merge pull request #939 from reuk/str-refine-use-after-free

Daniel Kroening · web-flow · commit f791fef65a03 · 2017-05-18T16:27:19.000+01:00
Fix use-after-free bugs in string refinement
diff --git a/src/goto-programs/string_refine_preprocess.cpp b/src/goto-programs/string_refine_preprocess.cpp
@@ -755,7 +755,7 @@ void string_refine_preprocesst::make_string_function(
   code_function_callt &function_call=to_code_function_call(target->code);
   code_typet function_type=to_code_type(function_call.function().type());
   code_typet new_type;
-  const source_locationt &loc=function_call.source_location();
+  const source_locationt loc=function_call.source_location();
   declare_function(function_name, function_type);
   function_application_exprt rhs;
   std::vector<exprt> args;
@@ -1074,7 +1074,8 @@ void string_refine_preprocesst::replace_string_calls(
   {
     if(target->is_function_call())
     {
-      code_function_callt &function_call=to_code_function_call(target->code);
+      const code_function_callt function_call=
+        to_code_function_call(target->code);
 
       if(function_call.function().id()==ID_symbol)
       {

Original file line number	Diff line number	Diff line change
`@@ -755,7 +755,7 @@ void string_refine_preprocesst::make_string_function(`
`755`	`755`	`code_function_callt &function_call=to_code_function_call(target->code);`
`756`	`756`	`code_typet function_type=to_code_type(function_call.function().type());`
`757`	`757`	`code_typet new_type;`
`758`		`- const source_locationt &loc=function_call.source_location();`
	`758`	`+ const source_locationt loc=function_call.source_location();`
`759`	`759`	`declare_function(function_name, function_type);`
`760`	`760`	`function_application_exprt rhs;`
`761`	`761`	`std::vector<exprt> args;`
`@@ -1074,7 +1074,8 @@ void string_refine_preprocesst::replace_string_calls(`
`1074`	`1074`	`{`
`1075`	`1075`	`if(target->is_function_call())`
`1076`	`1076`	`{`
`1077`		`- code_function_callt &function_call=to_code_function_call(target->code);`
	`1077`	`+ const code_function_callt function_call=`
	`1078`	`+ to_code_function_call(target->code);`
`1078`	`1079`
`1079`	`1080`	`if(function_call.function().id()==ID_symbol)`
`1080`	`1081`	`{`