[LifetimeSafety] Diagnose UAFs in high order functions
- Dominant language
- LLVM
- Stars
- 40.5k
- Forks
- 18.7k
- PR merge metrics
- PR metrics pending
Description
https://godbolt.org/z/5q64crznh
```cpp
#include
#include
using F = int *([[clang::lifetimebound]] int *);
int *g(F *f) {
int a = 42;
return f(&a);
}
int *h(std::function f) {
int a = 42;
return f(&a);
}
int main() {
F *f = +[]([[clang::lifetimebound]] int *p) { return p; };
int *result = g(f);
int *result2 = h(f);
printf("%d%d", *result, *result2);
}
```
`-Werror=lifetime-safety-all -fsanitize=address,undefined`
Contributor guide
Research direction
Start with the Godbolt reproducer and run it using -Werror=lifetime-safety-all -fsanitize=address,undefined. Compare the behavior of g and h, including the function-pointer and std::function paths, and determine which use-after-free cases are not diagnosed. Done means the high-order-function cases in the reproducer are correctly diagnosed or their expected behavior is documented in the relevant compiler tests.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- compilers
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100