Skip to content

Creating a std::string with a null pointer is undefined behaviour - #3220

Merged
airween merged 1 commit into
owasp-modsecurity:v3/masterfrom
eduar-hte:string-null
Aug 9, 2024
Merged

airween merged 1 commit into
owasp-modsecurity:v3/masterfrom
eduar-hte:string-null

Conversation

@eduar-hte

@eduar-hte eduar-hte commented Aug 8, 2024

Copy link
Copy Markdown
Contributor

what

Minor changes to avoid initializing a std::string with a null pointer.

why

cppreference mentions this about the constructor that receives a const char * (see here):

9) Constructs the string with the contents initialized with a copy of the null-terminated
character string pointed to by s. The length of the string is determined by the first null
character. The behavior is undefined if [s, s + Traits::length(s)) is not a valid range (for
example, if s is a null pointer).

references

C++23 introduces a deleted constructor to prevent this in static scenarios, which is how this issue was detected.

- cppreference mentions this about the constructor that receives a
  const char *:
  - Constructs the string with the contents initialized with a copy of
    the null-terminated character string pointed to by s. The length of
    the string is determined by the first null character. The behavior
    is undefined if [s, s + Traits::length(s)) is not a valid range
    (for example, if s is a null pointer).
- C++23 introduces a deleted constructor to prevent this in static
  scenarios, which is how this issue was detected.
@sonarqubecloud

sonarqubecloud Bot commented Aug 8, 2024

Copy link
Copy Markdown

Quality Gate Failed Quality Gate failed

Failed conditions
D Maintainability Rating on New Code (required ≥ A)

See analysis details on SonarCloud

Catch issues before they fail your Quality Gate with our IDE extension SonarLint

@airween airween left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM - thanks!

@airween
airween merged commit 7bdc3c8 into owasp-modsecurity:v3/master Aug 9, 2024
@eduar-hte
eduar-hte deleted the string-null branch August 9, 2024 17:12
@marcstern marcstern added the 3.x Related to ModSecurity version 3.x label Aug 20, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

3.x Related to ModSecurity version 3.x

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants