From eedc74e5d2d11310eeb69371e64bbfca5658201d Mon Sep 17 00:00:00 2001 From: Charalampos Stratakis Date: Mon, 22 Dec 2025 02:02:25 +0100 Subject: [PATCH] mip: Fix use-after-move in HighsLpRelaxation::loadModel Save lpmodel.num_col_ before passing lpmodel via std::move to lpsolver.passModel(). After the move, lpmodel is in a valid but unspecified state, making access to its members undefined behavior. Found by Coverity static analysis. --- highs/mip/HighsLpRelaxation.cpp | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/highs/mip/HighsLpRelaxation.cpp b/highs/mip/HighsLpRelaxation.cpp index d0d3c43ef7..d95f409b9b 100644 --- a/highs/mip/HighsLpRelaxation.cpp +++ b/highs/mip/HighsLpRelaxation.cpp @@ -237,11 +237,12 @@ void HighsLpRelaxation::loadModel() { for (HighsInt i = 0; i != lpmodel.num_row_; ++i) lprows.push_back(LpRow::model(i)); lpmodel.integrality_.clear(); + HighsInt num_col = lpmodel.num_col_; lpsolver.clearSolver(); lpsolver.clearModel(); lpsolver.passModel(std::move(lpmodel)); - colLbBuffer.resize(lpmodel.num_col_); - colUbBuffer.resize(lpmodel.num_col_); + colLbBuffer.resize(num_col); + colUbBuffer.resize(num_col); } void HighsLpRelaxation::resetToGlobalDomain() {