Fix use-after-free with ResChains
authorAndres Noetzli <noetzli@stanford.edu>
Wed, 24 May 2017 20:28:58 +0000 (13:28 -0700)
committerAndres Nötzli <andres.noetzli@gmail.com>
Fri, 26 May 2017 08:47:00 +0000 (01:47 -0700)
commit0a425613d5108efa5f623d075135f2e08d3dfde2
tree041568ac9d317a6672c81f730d6d7f512248cc83
parent97443967555b0e7fe6be4e6ab03b81383bc90430
Fix use-after-free with ResChains

This commit fixes an issue where the ResChain in `d_resolutionChains` gets
deleted here:

https://github.com/CVC4/CVC4/blob/master/src/proof/sat_proof_implementation.h#L729

The condition immediately after is false because the condition on line 727 is
true. Thus, `d_resolutionChains` now has a deleted entry for `id`.

When CVC4 afterwards gets the ResChain associated with `id` in
`checkResolution()`, it accesses the deleted entry:

https://github.com/CVC4/CVC4/blob/master/src/proof/sat_proof_implementation.h#L303
src/proof/sat_proof_implementation.h