debian/notmuch
1
0
Fork 0
mirror of https://git.notmuchmail.org/git/notmuch synced 2024-11-22 10:58:10 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

lib/message.cc: fix Coverity finding (use after free)

Browse source 
The object where pointer to `data` was received was deleted before
it was used in _notmuch_string_list_append().

Relevant Coverity messages follow:

3: extract
Assigning: data = std::__cxx11::string(message->doc.()).c_str(),
which extracts wrapped state from temporary of type std::__cxx11::string.

4: dtor_free
The internal representation of temporary of type std::__cxx11::string
is freed by its destructor.

5: use after free:
Wrapper object use after free (WRAPPER_ESCAPE)
Using internal representation of destroyed object local data.

(cherry picked from commit 06adc27668)
This commit is contained in:
Tomi Ollila 2017-03-18 00:28:48 +02:00 committed by David Bremner
parent 770d00a895
commit 930920d510
1 changed files with 2 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
lib/message.cc
View file

@ -849,9 +849,9 @@ _notmuch_message_ensure_filename_list (notmuch_message_t *message)
*
* It would be nice to do the upgrade of the document directly
* here, but the database is likely open in read-only mode. */
const char *data;
data = message->doc.get_data ().c_str ();
std::string datastr = message->doc.get_data ();
const char *data = datastr.c_str ();
if (data == NULL)
INTERNAL_ERROR ("message with no filename");