Return of address of stack memory associated with local variable

[monwarez]

libnitrokey/libnitrokey/LibraryException.h

Lines 49 to 54 in d22a0d2

	virtual const char *what() const throw() override {
	std::string s = " ";
	auto ts = [](size_t x){ return std::to_string(x); };
	std::string msg = std::string("Target buffer size is smaller than source: [source size, buffer size]")
	+s+ ts(source_size) +s+ ts(target_size);
	return msg.c_str();

This code trigger -Wreturn-stack-address since this is not a known at compile time string, and thus the content of the string will be use after free by the caller. Ideally if the exception would just return a string for each implementation, there will be no issue.

[monwarez]

I think that if the string msg is stored (like in some other exception classes) as a member then this should be good. But this will certainly break ABI.