Merge pull request #472 from secure-software-engineering/f-FixDanglingPointerInIDESolver

Fix Dangling Pointer in IDESolver

Author: pdschubert

include/phasar/PhasarLLVM/DataFlowSolver/IfdsIde/Solver/IDESolver.h

@@ -892,8 +892,8 @@ class IDESolver
     for (n_t n : Values) {
       for (n_t SP : ICF->getStartPointsOf(ICF->getFunctionOf(n))) {
         using TableCell = typename Table<d_t, d_t, EdgeFunctionPtrType>::Cell;
-        Table<d_t, d_t, EdgeFunctionPtrType> LookupByTarget;
-        LookupByTarget = JumpFn->lookupByTarget(n);
+        Table<d_t, d_t, EdgeFunctionPtrType> &LookupByTarget =
+            JumpFn->lookupByTarget(n);
         for (const TableCell &SourceValTargetValAndFunction :
              LookupByTarget.cellSet()) {
           d_t dPrime = SourceValTargetValAndFunction.getRowKey();
@@ -1098,7 +1098,9 @@ class IDESolver
             // return site using the composed function
             auto RevLookupResult = JumpFn->reverseLookup(c, d4);
             if (RevLookupResult) {
-              for (const auto &ValAndFunc : RevLookupResult->get()) {
+              llvm::SmallVector<std::pair<d_t, EdgeFunctionPtrType>, 2> ResCopy(
+                  RevLookupResult->get().begin(), RevLookupResult->get().end());
+              for (const auto &ValAndFunc : ResCopy) {
                 EdgeFunctionPtrType f3 = ValAndFunc.second;
                 if (!f3->equal_to(AllTop)) {
                   d_t d3 = ValAndFunc.first;

include/phasar/PhasarLLVM/DataFlowSolver/IfdsIde/Solver/JumpFunctions.h

@@ -169,7 +169,7 @@ template <typename AnalysisDomainTy, typename Container> class JumpFunctions {
    * The return value is a set of records of the form
    * (sourceVal,targetVal,edgeFunction).
    */
-  Table<d_t, d_t, EdgeFunctionPtrType> lookupByTarget(n_t Target) {
+  Table<d_t, d_t, EdgeFunctionPtrType> &lookupByTarget(n_t Target) {
     return NonEmptyLookupByTargetNode[Target];
   }