The internal representation of "std::string(this->code()->message())" escapes, but is destroyed when it exits scope.

[Richard <legalize@…>]

Coverity static analysis reported the following problem:

class BOOST_SYMBOL_VISIBLE future_error
     : public std::logic_error
 {
     system::error_code ec_;
 public:
     future_error(system::error_code ec)
     : logic_error(ec.message()),
       ec_(ec)
     {
     }
 
     const system::error_code& code() const BOOST_NOEXCEPT
     {
       return ec_;
     }
     const char* what() const BOOST_THREAD_NOEXCEPT_OR_THROW
     {
 CID 10932 (#2 of 2): Wrapper object use after free (WRAPPER_ESCAPE)1. escape: The internal representation of "std::string(this->code()->message())" escapes, but is destroyed when it exits scope. 
      return code().message().c_str();
     }
 };

[viboes]

Could you clarify what is the bug?

[Steven Watanabe]

boost::system::error_code::message returns a temporary string, which is destroyed when the function returns. The pointer returned by what() is dangling.

[viboes]

Replying to steven_watanabe:

boost::system::error_code::message returns a temporary string, which is destroyed when the function returns. The pointer returned by what() is dangling.

Oh I see. Please could you try just removing the overriding of the what() function?

[viboes]

Committed revision [83649].

[viboes]

(In [83660]) Thread: merge from trunk 1.54. Fix #8027,#8323,#8337.