Date: Fri, 26 Dec 2014 12:37:55 +0100
From: Tamas Szakaly <sghctoma@gmail.com>
To: notmuch@notmuchmail.org
Subject: BUG: Using pointer that points to a destructed string's content
Message-ID: <20141226113755.GA64154@pamparam>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8; x-action=pgp-signed
User-Agent: Mutt/1.5.23.1-rc1 (2014-03-12)
Precedence: list

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Dear notmuch developers,

The following line is from _notmuch_message_add_directory_terms in
lib/message.cc (line 652 in HEAD):

direntry = (*i).c_str ();

'i' is a Xapian::TermIterator, whose operator* returns a std::string by value.
This means that c_str() is called on a temporary, which is destructed after the
full expression (essentially the particular line in this case), so 'direntry'
will point to a destructed std::string's data.
(See https://gcc.gnu.org/onlinedocs/gcc/Temporaries.html)

One possible modification to correct this issue is using strdup:

direntry = strdup((*i).c_str ());

Note:
Despite the fact that it is wrong, it *generally* works, because delete[]-ing
the underlying character array in the destructor of std::string does not really
touch the memory content, and there is only a minor chance that this memory area
will be allocated again (e.g. from another thread). This caused me some headache
though with 'notmuch new' on FreeBSD 11-CURRENT, where jemalloc is configured so
that freed memory will be filled with 0x5a's.

Best regards,
sghctoma

- -- 
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBAgAGBQJUnUiQAAoJEE8tbNCQOSmESAsH/ih+EFx0WJEzImBkNe4I4H+0
Wj9u/ymmpgLwWnV0rg0oxnYoX5T6zT2e1jwTD73H7N4A2Xf2Susjbr6csTP2YyQB
aUbZ5/Ajq+COgpoEXTQUbrIPcIbdl0X05/k9f/OdNqZMHVK6j08hw2oqtpsq6v1+
PiuAa7kKrMda5rzLk08z1/qmJ6D7G2Trl6r5LPfytZhPwrphAJ9bWBofIIJLBQ0R
RdeTmGuzc7FBw1a1JqJWkDL1lI91VTD49Wr/VqYXPbfcWbaHhVYSklDshyEYaK/+
skemzV+aIWJiNHpkALdh3t+070caXlv5hwa826Q4kB0FMmkNlShjFqpXLJToEWo=
=hshP
-----END PGP SIGNATURE-----