From ac31e5f5e80027418cb06a7718b6ade3cacad8bc Mon Sep 17 00:00:00 2001
From: Tianjiao Yin <ytj@fb.com>
Date: Fri, 19 Feb 2016 10:40:46 -0800
Subject: [PATCH] fix dangling pointer bug in IPAddressV6

Summary: `mask(numBits)` returns a temporary variable. After its lifetime ends, subbytes becomes a dangling pointer.

Reviewed By: yfeldblum

Differential Revision: D2953699

fb-gh-sync-id: 5d5a35716ecaa1b3d96edb5a459615756848b92f
shipit-source-id: 5d5a35716ecaa1b3d96edb5a459615756848b92f
---
 folly/IPAddressV6.cpp | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/folly/IPAddressV6.cpp b/folly/IPAddressV6.cpp
index 290f1c0b..915767b4 100644
--- a/folly/IPAddressV6.cpp
+++ b/folly/IPAddressV6.cpp
@@ -374,8 +374,8 @@ const ByteArray16 IPAddressV6::fetchMask(size_t numBits) {
 // protected
 bool IPAddressV6::inBinarySubnet(const std::array<uint8_t, 2> addr,
                                  size_t numBits) const {
-  const unsigned char* subbytes = mask(numBits).bytes();
-  return (std::memcmp(addr.data(), subbytes, 2) == 0);
+  auto masked = mask(numBits);
+  return (std::memcmp(addr.data(), masked.bytes(), 2) == 0);
 }
 
 // static private
-- 
2.34.1