[Bug libstdc++/65113] New: string::copy violates traits requirements

["msebor at gmail dot com" <gcc-bugzilla@gcc.gnu.org>]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65113

            Bug ID: 65113
           Summary: string::copy violates traits requirements
           Product: gcc
           Version: 4.9.2
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: libstdc++
          Assignee: unassigned at gcc dot gnu.org
          Reporter: msebor at gmail dot com

libstdc++ string goes to quite a bit of trouble to avoid self-modifying calls
that could potentially corrupt the controlled sequence but there is at least
one case that has escaped this treatment.  The test case below shows that
basic_string::copy(char*, size_t) calls char_traits::copy with arguments that
violate the preconditions on the function.  That function in turn calls memcpy
with arguments that violate its own constraints.

I suspect that this use case may not have been intended when string was
designed.  It might be perhaps be worth checking with the LWG to see if
basic_string::copy should require the argument to be distinct from the object
on which it's called.

$ cat t.cpp && for dbg in -DNDEBUG ""; do g++ $dbg -Wall t.cpp && ./a.out &&
valgrind ./a.out; done
#include <assert.h>
#include <string>

template <class CharT>
struct Traits: std::char_traits<CharT> {
    static char* copy (CharT *d, const CharT *s, size_t n) {
        assert (d < s || s + n < d);
        return std::char_traits<CharT>::copy (d, s, n);
    }
};

template <class CharT, class Traits>
void f (const CharT *a, size_t len)
{
    typedef std::basic_string<CharT, Traits> String;
    String str (a, len);
    CharT* const s = &str [2];
    const typename String::size_type n = str.size () - 2;

    str.copy (s, n, 0);
}

int main ()
{
    const char S[] = "0123456789";

    f<char, Traits<char> >(S, sizeof S - 1);
}

==14329== Memcheck, a memory error detector
==14329== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al.
==14329== Using Valgrind-3.10.1 and LibVEX; rerun with -h for copyright info
==14329== Command: ./a.out
==14329== 
==14329== Source and destination overlap in memcpy(0x5a2005a, 0x5a20058, 8)
==14329==    at 0x4C2E13D: memcpy@@GLIBC_2.14 (in
/usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==14329==    by 0x400DBD: std::char_traits<char>::copy(char*, char const*,
unsigned long) (in /home/msebor/tmp/a.out)
==14329==    by 0x401407: Traits<char>::copy(char*, char const*, unsigned long)
(in /home/msebor/tmp/a.out)
==14329==    by 0x4012A6: std::basic_string<char, Traits<char>,
std::allocator<char> >::_M_copy(char*, char const*, unsigned long) (in
/home/msebor/tmp/a.out)
==14329==    by 0x40105B: std::basic_string<char, Traits<char>,
std::allocator<char> >::copy(char*, unsigned long, unsigned long) const (in
/home/msebor/tmp/a.out)
==14329==    by 0x400E54: void f<char, Traits<char> >(char const*, unsigned
long) (in /home/msebor/tmp/a.out)
==14329==    by 0x400D3D: main (in /home/msebor/tmp/a.out)
==14329== 
==14329== 
==14329== HEAP SUMMARY:
==14329==     in use at exit: 0 bytes in 0 blocks
==14329==   total heap usage: 1 allocs, 1 frees, 35 bytes allocated
==14329== 
==14329== All heap blocks were freed -- no leaks are possible
==14329== 
==14329== For counts of detected and suppressed errors, rerun with: -v
==14329== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 0 from 0)
a.out: t.cpp:7: static char* Traits<CharT>::copy(CharT*, const CharT*, size_t)
[with CharT = char; size_t = long unsigned int]: Assertion `d < s || s + n < d'
failed.
Aborted (core dumped)