Merge branch 'StringFormatStringifySinkUseAfterFreeFix' into ThreadSafeMemoizerMemoryLeakFix

This PR is now based on #14306

Author: dconeybe

Firestore/CHANGELOG.md

@@ -1,5 +1,6 @@
 # Unreleased
 - [fixed] Fixed memory leak in `Query.whereField()`. (#13978)
+- [fixed] Fixed use-after-free bug when internally formatting strings. (#14306)
 
 # 11.6.0
 - [fixed] Add conditional `Sendable` conformance so `ServerTimestamp<T>` is

Firestore/core/test/unit/util/string_format_test.cc

@@ -17,6 +17,7 @@
 #include "Firestore/core/src/util/string_format.h"
 
 #include "absl/strings/string_view.h"
+#include "gmock/gmock.h"
 #include "gtest/gtest.h"
 
 namespace firebase {
@@ -72,14 +73,18 @@ TEST(StringFormatTest, Bool) {
   EXPECT_EQ("Hello false", StringFormat("Hello %s", false));
 }
 
-TEST(StringFormatTest, Pointer) {
-  // pointers implicitly convert to bool. Make sure this doesn't happen in
-  // this API.
-  int value = 4;
-  EXPECT_NE("Hello true", StringFormat("Hello %s", &value));
+TEST(StringFormatTest, NullPointer) {
+  // pointers implicitly convert to bool. Make sure this doesn't happen here.
   EXPECT_EQ("Hello null", StringFormat("Hello %s", nullptr));
 }
 
+TEST(StringFormatTest, NonNullPointer) {
+  // pointers implicitly convert to bool. Make sure this doesn't happen here.
+  int value = 4;
+  EXPECT_THAT(StringFormat("Hello %s", &value),
+              testing::MatchesRegex("Hello (0x)?[0123456789abcdefABCDEF]+"));
+}
+
 TEST(StringFormatTest, Mixed) {
   EXPECT_EQ("string=World, bool=true, int=42, float=1.5",
             StringFormat("string=%s, bool=%s, int=%s, float=%s", "World", true,