Catching by value¶

ID: cpp/catch-by-value
Kind: problem
Security severity: 
Severity: warning
Precision: very-high
Tags:
   - efficiency
   - correctness
   - exceptions
Query suites:
   - cpp-security-and-quality.qls

Click to see the query in the CodeQL repository

Catching an exception by value will create a new local variable which is a copy of the originally thrown object. Creating the copy is slightly wasteful, but not catastrophic. More worrisome is the fact that if the type being caught is a strict supertype of the originally thrown type, then the copy might not contain as much information as the original exception.

void bad() {
  try {
    /* ... */
  }
  catch(std::exception a_copy_of_the_thrown_exception) {
    // Do something with a_copy_of_the_thrown_exception
  }
}

void good() {
  try {
    /* ... */
  }
  catch(const std::exception& the_thrown_exception) {
    // Do something with the_thrown_exception
  }
}