Page History

Lambda expressions may capture objects with automatic storage duration from the set of enclosing scopes (called the reaching scope) for use in the lambda's function body. These captures may be either explicit, by specifying the object to capture in the lambda's capture-list, or implicit, by using a capture-default and and referring to the object within the lambda's function body. When capturing an object explicitly or implicitly, the capture-default indicates that the object is either captured by copy or (using =) or captured by reference (using &). When an object is captured by copy, the lambda object will contain an unnamed nonstatic data member that is initialized to the value of the object being captured. This nonstatic data member's lifetime is that of the lambda object's lifetime. However, when an object is captured by reference, the lifetime of the referent is not tied to the lifetime of the lambda object.

...

In this compliant solution, the inner lambda captures i by copy instead of by reference:.

Code Block

bgColor	#ccccff
lang	cpp

auto g(int val) {
  auto outer = [val] {
    int i = val;
    auto inner = [i] {
      return i + 30;
    };
    return inner;
  };
  return outer();
}

void f() {
  auto fn = g(12);
  int j = fn();
}

...

Referencing an object outside of its lifetime can result in an attacker being able to run arbitrary code.

Rule	Severity	Likelihood	Remediation Cost	Priority	Level
EXP61-CPP	High	Probable	High	P6	L2

Automated Detection

Tool	Version	Checker	Description

Astrée

Include Page

	Astrée_V
	Astrée_V

invalid_pointer_dereference

Helix QAC

Include Page

	Helix QAC_V
	Helix QAC_V

DF4706, DF4707, DF4708

Klocwork

Include Page

	Klocwork_V
	Klocwork_V

LOCRET.RET

Parasoft C/C++test

Include Page

	Parasoft_V
	Parasoft_V

CERT_CPP-EXP61-a
CERT_CPP-EXP61-b
CERT_CPP-EXP61-c

Never return lambdas that capture local objects by reference
Never capture local objects from an outer lambda by reference
The lambda that captures local objects by reference should not be assigned to the variable with a greater lifetime

Polyspace Bug Finder

Include Page