std::make_format_args result stored in a variable
ID |
c.correctness.stored_make_format_args |
Severity |
low |
Remediation Complexity |
medium |
Remediation Risk |
medium |
Remediation Effort |
low |
Resource |
Lifetime |
Language |
C / C++ |
Description
Reports the result of std::make_format_args bound to a variable instead of used directly as a call argument.
Rationale
std::make_format_args returns a std::format_args object that holds references to its arguments, not copies of them — it does not extend their lifetime. If any of those arguments was itself a temporary (a numeric conversion, a std::string built inline, the result of another call), that temporary is destroyed at the end of the full expression, and the stored format_args is left holding a dangling reference the moment execution reaches the next statement. Using it later, e.g. in a subsequent std::vformat call, is undefined behavior.
The following code illustrates the pattern detected by this rule:
void store_before_use(int count, const char *name)
{
// FLAGGED: std::make_format_args result stored in a variable
auto args = std::make_format_args(count, name);
std::vformat("{} {}", args);
}