removeContradiction() Avoid use-after-free on multiple remove

As reported in https://sourceforge.net/p/cppcheck/discussion/general/thread/fa43fb8ab1/ removeContradiction() minValue/maxValue.remove(..) can access free'd memory as it removes all matching values by iterating over the complete list. Creating a full copy instead of a reference avoids this issue. Signed-off-by: Dirk Müller <[email protected]>
danmar · Nov 27, 2023 · bc63dbc · bc63dbc
1 parent db66105
commit bc63dbc
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/lib/token.cpp b/lib/token.cpp
@@ -1997,8 +1997,8 @@ static bool removeContradiction(std::list<ValueFlow::Value>& values)
                 auto compare = [](const ValueFlow::Value& x, const ValueFlow::Value& y) {
                     return x.compareValue(y, less{});
                 };
-                const ValueFlow::Value& maxValue = std::max(x, y, compare);
-                const ValueFlow::Value& minValue = std::min(x, y, compare);
+                ValueFlow::Value maxValue = std::max(x, y, compare);
+                ValueFlow::Value minValue = std::min(x, y, compare);
                 // TODO: Adjust non-points instead of removing them
                 if (maxValue.isImpossible() && maxValue.bound == ValueFlow::Value::Bound::Upper) {
                     values.remove(minValue);