Page History

...

In this noncompliant code example, the B * pointer value owned by a std::shared_ptr object is cast to the D * pointer type with dynamic_cast in an attempt to obtain a std::shared_ptr of the polymorphic derived type. However, this eventually results in undefined behavior as the same pointer is stored in two different std::shared_ptr objects. When g() exits, the pointer stored in Derivedderived is freed by the default deleter. Any further use of Polypoly results in accessing freed memory. When f() exits, the same pointer stored in Polypoly is destroyed, resulting in a double-free vulnerability.

#include <memory>

struct B {
  virtual ~B() = default; // Polymorphic object
  // ...
};
struct D : B {};

void g(std::shared_ptr<D> Derivedderived);

void f() {
  std::shared_ptr<B> Polypoly(new D);
  // ...
  g(std::shared_ptr<D>(dynamic_cast<D *>(Polypoly.get())));
  // Any use of Polypoly will now result in accessing freed memory.
}

...

In this compliant solution, the dynamic_cast is replaced with a call to std::dynamic_pointer_cast(), which returns a std::shared_ptr of the polymorphic type with the valid shared pointer value. When g() exits, the reference count to the underlying pointer is decremented by the destruction of Derivedderived, but because of the reference held by Polypoly (within f()), the stored pointer value is still valid after g() returns.

#include <memory>

struct B {
  virtual ~B() = default; // Polymorphic object
  // ...
};
struct D : B {};

void g(std::shared_ptr<D> Derivedderived);

void f() {
  std::shared_ptr<B> Polypoly(new D);
  // ...
  g(std::dynamic_pointer_cast<D, B>(Polypoly));
  // Polypoly is still referring to a valid pointer value.
}

...