Skip to content

Use after free, double free possible in safe function #208

@fuhsnn

Description

@fuhsnn

I didn't find how to express allocation ownership without std2 on the documentation site, so I just played around blindly on godbolt.
It seems that raw pointer checks can just be cast away without some kind of unsafe block.

#feature on safety

void fn(void) safe {
    int* p = new int(35);
    delete p;
    *(int^)p = 5315313; 
    delete p;
}

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions