• via Digitalmars-d-bugs (22/22) Oct 12 2015 https://issues.dlang.org/show_bug.cgi?id=15191

via Digitalmars-d-bugs <digitalmars-d-bugs puremagic.com> writes:

https://issues.dlang.org/show_bug.cgi?id=15191

          Issue ID: 15191
           Summary: DIP25: Taking address of ref return is not type
                    checked soundly
           Product: D
           Version: D2
          Hardware: All
                OS: All
            Status: NEW
          Severity: normal
          Priority: P1
         Component: dmd
          Assignee: nobody puremagic.com
          Reporter: timon.gehr gmx.ch

The following code corrupts memory:

enum N=100;
ref int[N] foo(return ref int[N] s) safe{ return s; }
int[N]* bar(return ref int[N] s) safe{ return &foo(s); }
ref int[N] baz() safe{ int[N] s; return *bar(s); }
void bang(ref int[N] x) safe{ x[]=0x25BAD; }
void main() safe{ bang(baz()); }

--