From 8fdc8ebc3774664ea0127a901ada663a4eb20275 Mon Sep 17 00:00:00 2001 From: Nicholas Bishop Date: Sun, 25 Oct 2026 15:26:19 +0000 Subject: [PATCH] Fix use-after-free of var name in BuildDefaultValueExpr (#8025) The `var_name` string was built on the stack and then added to the `IdentifierStore`. This lead to use-after-free, since `IdentifierStore` just stores a `llvm::StringRef`. Add it to `ast_context().Idents` to provide a longer-lived reference. --- toolchain/check/cpp/export.cpp | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/toolchain/check/cpp/export.cpp b/toolchain/check/cpp/export.cpp index c4bc948a719b..eb0223326f35 100644 --- a/toolchain/check/cpp/export.cpp +++ b/toolchain/check/cpp/export.cpp @@ -1224,8 +1224,9 @@ static auto BuildDefaultValueExpr(Context& context, SemIR::LocId loc_id, mangler.Mangle(target.function_id, SemIR::SpecificId::None); llvm::SmallString<64> var_name = llvm::formatv( "__carbon_default_value_{}_{}", mangled_fn_name, parameter_index); + auto& ident = context.ast_context().Idents.get(var_name); auto name_id = - SemIR::NameId::ForIdentifier(context.identifiers().Add(var_name)); + SemIR::NameId::ForIdentifier(context.identifiers().Add(ident.getName())); // First we synthesize the variable definition by creating an EntityName from // the generated name stored in `var_name`. We want to generate a