Re: BUG: Using pointer that points to a destructed string's content

diff --git a/1e/80eccd42bc5d50d7d2ddbbb1603889c93185cc b/1e/80eccd42bc5d50d7d2ddbbb1603889c93185cc
new file mode 100644 (file)
index 0000000..3c99a02
--- /dev/null
+++ b/1e/80eccd42bc5d50d7d2ddbbb1603889c93185cc
@@ -0,0 +1,84 @@
+Return-Path: <david@tethera.net>\r
+X-Original-To: notmuch@notmuchmail.org\r
+Delivered-To: notmuch@notmuchmail.org\r
+Received: from localhost (localhost [127.0.0.1])\r
+       by olra.theworths.org (Postfix) with ESMTP id 1801F431FCF\r
+       for <notmuch@notmuchmail.org>; Fri, 26 Dec 2014 14:03:25 -0800 (PST)\r
+X-Virus-Scanned: Debian amavisd-new at olra.theworths.org\r
+X-Spam-Flag: NO\r
+X-Spam-Score: 0\r
+X-Spam-Level: \r
+X-Spam-Status: No, score=0 tagged_above=-999 required=5 tests=[none]\r
+       autolearn=disabled\r
+Received: from olra.theworths.org ([127.0.0.1])\r
+       by localhost (olra.theworths.org [127.0.0.1]) (amavisd-new, port 10024)\r
+       with ESMTP id KcCTnRPUcB45 for <notmuch@notmuchmail.org>;\r
+       Fri, 26 Dec 2014 14:03:21 -0800 (PST)\r
+Received: from yantan.tethera.net (yantan.tethera.net [199.188.72.155])\r
+       (using TLSv1 with cipher DHE-RSA-AES128-SHA (128/128 bits))\r
+       (No client certificate requested)\r
+       by olra.theworths.org (Postfix) with ESMTPS id E091C431FAF\r
+       for <notmuch@notmuchmail.org>; Fri, 26 Dec 2014 14:03:21 -0800 (PST)\r
+Received: from remotemail by yantan.tethera.net with local (Exim 4.80)\r
+       (envelope-from <david@tethera.net>)\r
+       id 1Y4cyc-0007qM-Vs; Fri, 26 Dec 2014 18:03:18 -0400\r
+Received: (nullmailer pid 3992 invoked by uid 1000); Fri, 26 Dec 2014\r
+       22:03:13 -0000\r
+From: David Bremner <david@tethera.net>\r
+To: Tamas Szakaly <sghctoma@gmail.com>, notmuch@notmuchmail.org\r
+Subject: Re: BUG: Using pointer that points to a destructed string's content\r
+In-Reply-To: <20141226113755.GA64154@pamparam>\r
+References: <20141226113755.GA64154@pamparam>\r
+User-Agent: Notmuch/0.19+7~g5d7f7a6 (http://notmuchmail.org) Emacs/24.4.1\r
+       (x86_64-pc-linux-gnu)\r
+Date: Fri, 26 Dec 2014 23:03:13 +0100\r
+Message-ID: <87oaqqf4ri.fsf@maritornes.cs.unb.ca>\r
+MIME-Version: 1.0\r
+Content-Type: text/plain\r
+X-BeenThere: notmuch@notmuchmail.org\r
+X-Mailman-Version: 2.1.13\r
+Precedence: list\r
+List-Id: "Use and development of the notmuch mail system."\r
+       <notmuch.notmuchmail.org>\r
+List-Unsubscribe: <http://notmuchmail.org/mailman/options/notmuch>,\r
+       <mailto:notmuch-request@notmuchmail.org?subject=unsubscribe>\r
+List-Archive: <http://notmuchmail.org/pipermail/notmuch>\r
+List-Post: <mailto:notmuch@notmuchmail.org>\r
+List-Help: <mailto:notmuch-request@notmuchmail.org?subject=help>\r
+List-Subscribe: <http://notmuchmail.org/mailman/listinfo/notmuch>,\r
+       <mailto:notmuch-request@notmuchmail.org?subject=subscribe>\r
+X-List-Received-Date: Fri, 26 Dec 2014 22:03:25 -0000\r
+\r
+Tamas Szakaly <sghctoma@gmail.com> writes:\r
+\r
+> The following line is from _notmuch_message_add_directory_terms in\r
+> lib/message.cc (line 652 in HEAD):\r
+>\r
+> direntry = (*i).c_str ();\r
+>\r
+> 'i' is a Xapian::TermIterator, whose operator* returns a std::string by value.\r
+> This means that c_str() is called on a temporary, which is destructed after the\r
+> full expression (essentially the particular line in this case), so 'direntry'\r
+> will point to a destructed std::string's data.\r
+> (See https://gcc.gnu.org/onlinedocs/gcc/Temporaries.html)\r
+\r
+Does the following patch fix it for you? I have to double check that\r
+direntry wasn't needed for something, but the test suite passes ;).\r
+\r
+diff --git a/lib/message.cc b/lib/message.cc\r
+index a7a13cc..24d0d5b 100644\r
+--- a/lib/message.cc\r
++++ b/lib/message.cc\r
+@@ -649,10 +649,8 @@ _notmuch_message_add_directory_terms (void *ctx, notmuch_message_t *message)\r
+       /* Indicate that there are filenames remaining. */\r
+       status = NOTMUCH_STATUS_DUPLICATE_MESSAGE_ID;\r
+ \r
+-      direntry = (*i).c_str ();\r
+-      direntry += direntry_prefix_len;\r
+-\r
+-      directory_id = strtol (direntry, &colon, 10);\r
++      directory_id = strtol (\r
++          (*i).c_str () + direntry_prefix_len, &colon, 10);\r
+ \r
+       if (colon == NULL || *colon != ':')\r
+           INTERNAL_ERROR ("malformed direntry");\r