llvm / llvm/llvm-project

[LifetimeSafety] Diagnose UAFs in high order functions

Open
#211,472 1 comment 0 reactions 0 assignees View on GitHub
clang:temporal-safety
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

https://godbolt.org/z/5q64crznh

```cpp
#include
#include

using F = int *([[clang::lifetimebound]] int *);

int *g(F *f) {
int a = 42;
return f(&a);
}

int *h(std::function f) {
int a = 42;
return f(&a);
}

int main() {
F *f = +[]([[clang::lifetimebound]] int *p) { return p; };
int *result = g(f);
int *result2 = h(f);
printf("%d%d", *result, *result2);
}

```

`-Werror=lifetime-safety-all -fsanitize=address,undefined`

Contributor guide

Open the contributing guide

Research direction

Start with the Godbolt reproducer and run it using -Werror=lifetime-safety-all -fsanitize=address,undefined. Compare the behavior of g and h, including the function-pointer and std::function paths, and determine which use-after-free cases are not diagnosed. Done means the high-order-function cases in the reproducer are correctly diagnosed or their expected behavior is documented in the relevant compiler tests.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
compilers
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.