Meinersbur added inline comments.
================ Comment at: clang/lib/Parse/ParsePragma.cpp:1010 + StringRef Str = PragmaName.getIdentifierInfo()->getName(); + StringRef ClangLoopStr = "clang loop " + Str.str(); + Str = llvm::StringSwitch<StringRef>(Str) ---------------- [serious] Use-after-free here again. This line will do the following: ``` StringRef ClangLoopStr; { std::string tmp = "clang loop " + Str.str() ClangLoopStr = tmp; // tmp.~string() } // Any use of ClangLoopStr will use memory released by tmp.~string() ``` Let me suggest a solution: ``` std::string ClangLoopStr = (Twine("clang loop ") + Str).str(); std::string Result = llvm::StringSwitch<StringRef>(Str) .Case("loop", ClangLoopStr) .Case("unroll_and_jam", Str) .Case("unroll", Str) .Default(""); return Result; // NRVO, ClangLoopStr will be released here, but if it was chosen by the StringSwitch, Result will hold a copy, so ClangLoopStr is not referenced anymore. ``` Note that this will alloc one more std::string in the non-ClangLoopStr cases than before the patch, but I don't think it's important. CHANGES SINCE LAST ACTION https://reviews.llvm.org/D64564/new/ https://reviews.llvm.org/D64564 _______________________________________________ cfe-commits mailing list cfe-commits@lists.llvm.org https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits