Forbid passing temporaries to soci::use()

Previously code doing this compiled but resulted in undefined behaviour
due to using variable memory after destroying it, so explicitly prevent
it from compiling now to avoid run-time problems later.

Document this incompatible change and update the change log for the next
release.

Closes SOCI#1070.

Closes SOCI#1071.

Author: StefanVK

CHANGES

@@ -1,9 +1,30 @@
 This file contains the history of changes in the SOCI library.
 
-Latest version is v4.0.3 released on 2022-02-14.
+Please read at least the following section when upgrading from
+a previous version of the library.
+
+INCOMPATIBLE CHANGES
+====================
+
+Changes in behaviour not resulting in compilation errors
+--------------------------------------------------------
+
+Changes in behaviour which may result in build errors
+-----------------------------------------------------
+
+- Temporary values cannot be passed to soci::use() any longer.
+  Previously this would compile but result in undefined behaviour
+  during run-time, but now this doesn't compile any longer. Please
+  create a temporary variable holding the value if necessary (#1070).
+
+
+Other changes in v4.1.0:
+
+
+History of the changes in the previous versions:
 
 ---
-Version 4.0.3 differs from 4.0.2 in the following ways:
+Version 4.0.3 (released on 2022-02-14) differs from 4.0.2 in the following ways:
 
 Changes affecting all or multiple backends:
  - Fix opening sessions from pool (#891).

include/soci/use.h

@@ -46,6 +46,13 @@ struct use_container<T, no_indicator>
 
 } // namespace details
 
+// soci::use is deleted for rvalues because it will likely lead to subtle stack-use-after-scope bugs.
+template <typename T>
+details::use_container<T, details::no_indicator> use(T &&t, const std::string &name = std::string()) = delete;
+
+template <typename T>
+details::use_container<const T, indicator> use(T &&t, indicator & ind, std::string const &name = std::string()) = delete;
+
 template <typename T>
 details::use_container<T, details::no_indicator> use(T &t, const std::string &name = std::string())
 { return details::use_container<T, details::no_indicator>(t, name); }

tests/oracle/test-oracle.cpp

@@ -1028,8 +1028,8 @@ TEST_CASE("Oracle to_number with rowset", "[oracle][rowset][to_number]")
         rs = (sql.prepare << "select to_number('123456789012345') from dual");
     double d = rs.begin()->get<double>(0);
     ASSERT_EQUAL_EXACT(d, 123456789012345);
-
-    rs = (sql.prepare << "select to_number(:t) from dual", use(3.14));
+    const double pi = 3.14;
+    rs = (sql.prepare << "select to_number(:t) from dual", use(pi));
     d = rs.begin()->get<double>(0);
     ASSERT_EQUAL_EXACT(d, 3.14);
 }