From bc63dbc439ceb457dd1369cc864250b0fa4c50f6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Dirk=20M=C3=BCller?= Date: Tue, 28 Nov 2023 00:03:24 +0100 Subject: [PATCH] removeContradiction() Avoid use-after-free on multiple remove MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit As reported in https://sourceforge.net/p/cppcheck/discussion/general/thread/fa43fb8ab1/ removeContradiction() minValue/maxValue.remove(..) can access free'd memory as it removes all matching values by iterating over the complete list. Creating a full copy instead of a reference avoids this issue. Signed-off-by: Dirk Müller --- lib/token.cpp | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/token.cpp b/lib/token.cpp index be6d7730e971..711f64a00e39 100644 --- a/lib/token.cpp +++ b/lib/token.cpp @@ -1997,8 +1997,8 @@ static bool removeContradiction(std::list& values) auto compare = [](const ValueFlow::Value& x, const ValueFlow::Value& y) { return x.compareValue(y, less{}); }; - const ValueFlow::Value& maxValue = std::max(x, y, compare); - const ValueFlow::Value& minValue = std::min(x, y, compare); + ValueFlow::Value maxValue = std::max(x, y, compare); + ValueFlow::Value minValue = std::min(x, y, compare); // TODO: Adjust non-points instead of removing them if (maxValue.isImpossible() && maxValue.bound == ValueFlow::Value::Bound::Upper) { values.remove(minValue);