From eb2c3ce5f93b8d91fe028a744b524ec18192d9ae Mon Sep 17 00:00:00 2001
From: Piotr Balcer <piotr.balcer@intel.com>
Date: Tue, 26 Nov 2024 15:41:53 +0100
Subject: [PATCH] [L0] fix use-after-free in urProgramLinkExp

Found by memcheck. The BuildFlagPtr vector was being
populated by the backing data of temporarily created
std::string.
---
 source/adapters/level_zero/program.cpp | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/source/adapters/level_zero/program.cpp b/source/adapters/level_zero/program.cpp
index 6ca6e94b25..1b66d12a30 100644
--- a/source/adapters/level_zero/program.cpp
+++ b/source/adapters/level_zero/program.cpp
@@ -452,9 +452,11 @@ ur_result_t urProgramLinkExp(
       // Build flags may be different for different devices, so handle them
       // here. Clear values of the previous device first.
       BuildFlagPtrs.clear();
+      std::vector<std::string> TemporaryOptionsStrings;
       for (uint32_t I = 0; I < count; I++) {
-        BuildFlagPtrs.push_back(
-            phPrograms[I]->getBuildOptions(ZeDevice).c_str());
+        TemporaryOptionsStrings.push_back(
+            phPrograms[I]->getBuildOptions(ZeDevice));
+        BuildFlagPtrs.push_back(TemporaryOptionsStrings.back().c_str());
       }
       ZeExtModuleDesc.pBuildFlags = BuildFlagPtrs.data();
       if (count == 1)