Fix heap use-after-free in string_refinement.cpp

reuk · reuk · commit 47933cbf3fb0 · 2017-11-24T18:09:24.000Z
diff --git a/src/solvers/refinement/string_refinement.cpp b/src/solvers/refinement/string_refinement.cpp
@@ -1808,7 +1808,7 @@ static void initial_index_set(
 
   while(!to_process.empty())
   {
-    const exprt &cur = to_process.back();
+    const exprt cur = to_process.back();
     to_process.pop_back();
     if(cur.id() == ID_index && is_char_type(cur.type()))
     {

Original file line number	Diff line number	Diff line change
`@@ -1808,7 +1808,7 @@ static void initial_index_set(`
`1808`	`1808`
`1809`	`1809`	`while(!to_process.empty())`
`1810`	`1810`	`{`
`1811`		`- const exprt &cur = to_process.back();`
	`1811`	`+ const exprt cur = to_process.back();`
`1812`	`1812`	`to_process.pop_back();`
`1813`	`1813`	`if(cur.id() == ID_index && is_char_type(cur.type()))`
`1814`	`1814`	`{`