[Bug libstdc++/21172] potential integer overflow error in STL heap functions

[Bug libstdc++/21172] potential integer overflow error in STL heap functions

[pcarlini at suse dot de]

------- Comment #5 from pcarlini at suse dot de  2006-04-17 18:35 -------
Working on a fix.


-- 

pcarlini at suse dot de changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         AssignedTo|unassigned at gcc dot gnu   |pcarlini at suse dot de
                   |dot org                     |
             Status|NEW                         |ASSIGNED


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=21172

[Bug libstdc++/21172] potential integer overflow error in STL heap functions

[pcarlini at suse dot de]

------- Comment #6 from pcarlini at suse dot de  2006-10-18 11:37 -------
A straightforward approach to the problem uses the unsigned type associated
with _Distance (via __gnu_cxx::__add_unsigned) to avoid the risk of overflows
in __adjust_heap completely. I'm currently looking into the cleanest way to
follow this route...


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=21172

[Bug libstdc++/21172] potential integer overflow error in STL heap functions

[paolo at gcc dot gnu dot org]

------- Comment #7 from paolo at gcc dot gnu dot org  2007-02-13 00:25 -------
Subject: Bug 21172

Author: paolo
Date: Tue Feb 13 00:25:30 2007
New Revision: 121875

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=121875
Log:
2007-02-12  Paolo Carlini  <pcarlini@suse.de>

        PR libstdc++/21172
        * include/bits/stl_heap.h (__adjust_heap(_RandomAccessIterator,
        _Distance, _Distance, _Tp), __adjust_heap(_RandomAccessIterator,
        _Distance, _Distance, _Tp, _Compare)): Avoid potential integer
        overflow.

        * include/bits/stl_heap.h (__is_heap(_RandomAccessIterator,
        _RandomAccessIterator), __is_heap(_RandomAccessIterator,
        _RandomAccessIterator, _StrictWeakOrdering): Mark inline.
        (make_heap(_RandomAccessIterator, _RandomAccessIterator,
        _Compare)): Do not mark inline.

        * include/bits/stl_heap.h (push_heap(_RandomAccessIterator,
        _RandomAccessIterator), sort_heap(_RandomAccessIterator,
        _RandomAccessIterator)): Uncomment __glibcxx_requires_heap.

Modified:
    trunk/libstdc++-v3/ChangeLog
    trunk/libstdc++-v3/include/bits/stl_heap.h


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=21172

[Bug libstdc++/21172] potential integer overflow error in STL heap functions

[pcarlini at suse dot de]

------- Comment #8 from pcarlini at suse dot de  2007-02-13 00:26 -------
Fixed.


-- 

pcarlini at suse dot de changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|                            |FIXED
   Target Milestone|---                         |4.3.0


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=21172

[Bug libstdc++/21172] potential integer overflow error in STL heap functions

[pcarlini at suse dot de]

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
     Ever Confirmed|                            |1
   Last reconfirmed|0000-00-00 00:00:00         |2005-04-28 00:11:11
               date|                            |


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=21172

[Bug libstdc++/21172] potential integer overflow error in STL heap functions

[pcarlini at suse dot de]

------- Additional Comments From pcarlini at suse dot de  2005-04-28 00:08 -------
Ok, let's reopen the PR as "enhancement": actually, it's easy to produce a
testcase that leads to __secondChild growing beyond __len and the latter
can be equal to the biggest representable _Distance.

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
           Severity|normal                      |enhancement
             Status|RESOLVED                    |UNCONFIRMED
         Resolution|INVALID                     |


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=21172

[Bug libstdc++/21172] potential integer overflow error in STL heap functions

[pcarlini at suse dot de]

------- Additional Comments From pcarlini at suse dot de  2005-04-27 19:26 -------
Please, either provide an analysis that the problem really happens, *given the
specific algorithm*, or provide a testcase.

-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=21172

[Bug libstdc++/21172] potential integer overflow error in STL heap functions

[pete_a90 at yahoo dot com]

------- Additional Comments From pete_a90 at yahoo dot com  2005-04-27 19:09 -------
I know there are no practical risks to this (heap isn't that popular and it's practically impossible to allocate an array that large) but it won't work if the user made a custom iterator with unsigned char as the size_type and signed char as the distance_type on a machine with small chars. The initialization of __secondChild isn't the problem, it's the updating of it in the loop that will cause it.


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=21172

[Bug libstdc++/21172] potential integer overflow error in STL heap functions

[pcarlini at suse dot de]

------- Additional Comments From pcarlini at suse dot de  2005-04-26 15:21 -------
Actually, all the callers of __adjust_heap either pass a null second argument,
or a "small" second argument (case of make_heap). Thus, no real risks. Notice
that the function is an internal detail (double underscore prefix) and is not
supposed to be externally used.

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
         Resolution|                            |INVALID


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=21172