scipopt / russcip

Rust interface for SCIP
https://crates.io/crates/russcip
Apache License 2.0
37 stars 11 forks source link

Use after free in Constrint and Variable #152

Open Andful opened 2 weeks ago

Andful commented 2 weeks ago

When inspecting Model and Constraint, I noticed that Model::drop frees every constraint, variable, but Constrain::name and Variable::name assume them not to be freed.

use russcip::prelude::*;

fn main() {
    // Create model
    let mut model = Model::new()
        .hide_output()
        .include_default_plugins()
        .create_prob("test")
        .set_obj_sense(ObjSense::Maximize);

    // Add variables
    let x1 = model.add_var(0., f64::INFINITY, 3., "x1", VarType::Integer);

    drop(model);

    println!("{}", x1.name());
}

This causes segmentation fault