Skip to content

Commit c2ed5b6

Browse files
authored
Fix use-after-free bug of DataType value.
Everytime when we call DataType<T>::value(), a new string is constructed and assign to the static data_type. So if we call it twice, the first one has been released when we get the second one. std::string data_type(value1, strlen(value2)); If the parameters are evaluated from left to right, value1 becomes invalid while we are using it to construct data_type. This is the simplest fix, which passes a single c_str as parameter. A better solution is to refactor this whole piece of code, to try to avoid constructing data_type everytime, or avoid c_str.
1 parent ca1bf3a commit c2ed5b6

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

ros/roscpp_core/roscpp_traits/include/ros/protobuffer_traits.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,7 @@ struct MD5Sum<T, typename boost::enable_if<boost::is_base_of< ::google::protobuf
6969
{
7070
static const char* value()
7171
{
72-
std::string data_type(DataType<T>::value(), strlen(DataType<T>::value()));
72+
std::string data_type(DataType<T>::value());
7373
if (type_md5_map.count(data_type) == 0)
7474
{
7575
type_md5_map[data_type] = ros::md5::MD5(data_type).toStr();

0 commit comments

Comments
 (0)