Skip to content

Add lifetimebound to ArrayRef and StringRef to detect dangling issues #113533

Closed
@hokein

Description

@hokein
Collaborator

Adding the lifetimebound annotation to the ArrayRef's array constructor can enable us to detect the following use-after-free issues:

ArrayRef<int> test() {
   int array[10];
   return array; // bug, return a stack local address
}

cc @Xazax-hun, @usx95

Activity

added
clang:memory-safetyIssue/FR relating to the lifetime analysis in Clang (-Wdangling, -Wreturn-local-addr)
on Oct 24, 2024
Xazax-hun

Xazax-hun commented on Oct 24, 2024

@Xazax-hun
Collaborator

Probably people run into that less frequently, but we could annotate all containers in ADT including small vector and such. They have a number of APIs handing out pointers and references that have the same lifetime as the container itself.

hokein

hokein commented on Nov 6, 2024

@hokein
CollaboratorAuthor

Probably people run into that less frequently, but we could annotate all containers in ADT including small vector and such. They have a number of APIs handing out pointers and references that have the same lifetime as the container itself.

Thanks for the idea, annotating all containers in ADT could certainly help.

My intention of this issue primarily targets the ArrayRef and StringRef constructors, which have already discovered some bugs in our internal codebase.

hokein

hokein commented on Nov 6, 2024

@hokein
CollaboratorAuthor

Closing this issue now, as annotations for both ArrayRef and StringRef have been added.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    clang:memory-safetyIssue/FR relating to the lifetime analysis in Clang (-Wdangling, -Wreturn-local-addr)

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

      Development

      No branches or pull requests

        Participants

        @Xazax-hun@hokein

        Issue actions

          Add `lifetimebound` to ArrayRef and StringRef to detect dangling issues · Issue #113533 · llvm/llvm-project