Modern C++ Won't Save Us

[Walter Bright]

On 4/26/2021 1:20 PM, MoonlightSentinel wrote:
> On Monday, 26 April 2021 at 07:21:38 UTC, Petar Kirov [ZombineDev] wrote:
>> Unfortunately, Phobos got bitten by exactly the same use-after-free bug as the 
>> article showcases:
>>
>> https://github.com/dlang/phobos/pull/7988/commits/08927149ccbb3a20fb7e97687065fe66a33e2cb8 
>>
> 
> Isn't this an error that should be detected by DIP25 / DIP1000? I was quite 
> surprised that -preview=dip1000 accepted this code.

The checks are defeated by the @trusted function:

     @property inout(To)* buffPtr() inout
     {
         return _ptr == useStack ? _buff.ptr : _ptr;
     }


https://github.com/dlang/phobos/blob/master/std/internal/cstring.d#L229