Project

General

Profile

Actions

Bug #57516

closed

access a destructed temporary variable in rgw_sync_checkpoint.cc

Added by Yuval Lifshitz over 1 year ago. Updated 8 months ago.

Status:
Resolved
Priority:
Normal
Assignee:
-
Target version:
-
% Done:

0%

Source:
Tags:
low-hanging-fruit
Backport:
Regression:
No
Severity:
3 - minor
Reviewed:
Affected Versions:
ceph-qa-suite:
Pull request ID:
Crash signature (v1):
Crash signature (v2):

Description

in the function "empty()" when "markers.get()" return the default value, m is a reference to a temporary std::string that is already destroyed when "m.empty()" is invoked.
see:

bool empty(const BucketIndexShardsManager& markers, int size)
{
  for (int i = 0; i < size; ++i) {
    const auto& m = markers.get(i, "");
    if (!m.empty()) {
      return false;
    }   
  }
  return true;
}

the default value should be an explicit std::string that lives in the scope. in the above case it could be a static const empty string.
see example: https://godbolt.org/z/WGfE68E65

coverity CID 1511024

Actions

Also available in: Atom PDF