提交 74ad88bb 编写于 作者: A A. Unique TensorFlower 提交者: TensorFlower Gardener

Fix a subtle use-after-free issue in XStatVisitor::RefValue()

The ternary expression here coerces both sides to the same type, which in this case is a std::string.  As a result, it constructs a temporary std::string from the "" literal, and this temporary is then destroyed once the expression is evaluated, leaving nothing holding the backing data that the return value is bound to.  The same problem happens with the other side, where a std::string is constructed from the std::string& reference returned by the protobuf accessor function.

We fix this by explicitly binding both sides of the ternary expression to a string_view independently.

PiperOrigin-RevId: 306551928
Change-Id: I2f5c812d32c32e955bb903eea4fbf30d236db089
上级 c609fda7
......@@ -27,7 +27,7 @@ XStatVisitor::XStatVisitor(const XPlaneVisitor* plane, const XStat* stat)
absl::string_view XStatVisitor::RefValue() const {
const XStatMetadata* metadata = plane_->GetStatMetadata(stat_->ref_value());
return metadata ? metadata->name() : "";
return metadata ? absl::string_view(metadata->name()) : absl::string_view();
}
std::string XStatVisitor::ToString() const {
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册