From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 17075 invoked by alias); 19 Feb 2015 03:07:12 -0000 Mailing-List: contact gcc-bugs-help@gcc.gnu.org; run by ezmlm Precedence: bulk List-Id: List-Archive: List-Post: List-Help: Sender: gcc-bugs-owner@gcc.gnu.org Received: (qmail 17013 invoked by uid 48); 19 Feb 2015 03:06:56 -0000 From: "msebor at gmail dot com" To: gcc-bugs@gcc.gnu.org Subject: [Bug libstdc++/65113] New: string::copy violates traits requirements Date: Thu, 19 Feb 2015 03:07:00 -0000 X-Bugzilla-Reason: CC X-Bugzilla-Type: new X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: gcc X-Bugzilla-Component: libstdc++ X-Bugzilla-Version: 4.9.2 X-Bugzilla-Keywords: X-Bugzilla-Severity: normal X-Bugzilla-Who: msebor at gmail dot com X-Bugzilla-Status: UNCONFIRMED X-Bugzilla-Priority: P3 X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org X-Bugzilla-Target-Milestone: --- X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: bug_id short_desc product version bug_status bug_severity priority component assigned_to reporter Message-ID: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: 7bit X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/ Auto-Submitted: auto-generated MIME-Version: 1.0 X-SW-Source: 2015-02/txt/msg02084.txt.bz2 https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65113 Bug ID: 65113 Summary: string::copy violates traits requirements Product: gcc Version: 4.9.2 Status: UNCONFIRMED Severity: normal Priority: P3 Component: libstdc++ Assignee: unassigned at gcc dot gnu.org Reporter: msebor at gmail dot com libstdc++ string goes to quite a bit of trouble to avoid self-modifying calls that could potentially corrupt the controlled sequence but there is at least one case that has escaped this treatment. The test case below shows that basic_string::copy(char*, size_t) calls char_traits::copy with arguments that violate the preconditions on the function. That function in turn calls memcpy with arguments that violate its own constraints. I suspect that this use case may not have been intended when string was designed. It might be perhaps be worth checking with the LWG to see if basic_string::copy should require the argument to be distinct from the object on which it's called. $ cat t.cpp && for dbg in -DNDEBUG ""; do g++ $dbg -Wall t.cpp && ./a.out && valgrind ./a.out; done #include #include template struct Traits: std::char_traits { static char* copy (CharT *d, const CharT *s, size_t n) { assert (d < s || s + n < d); return std::char_traits::copy (d, s, n); } }; template void f (const CharT *a, size_t len) { typedef std::basic_string String; String str (a, len); CharT* const s = &str [2]; const typename String::size_type n = str.size () - 2; str.copy (s, n, 0); } int main () { const char S[] = "0123456789"; f >(S, sizeof S - 1); } ==14329== Memcheck, a memory error detector ==14329== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al. ==14329== Using Valgrind-3.10.1 and LibVEX; rerun with -h for copyright info ==14329== Command: ./a.out ==14329== ==14329== Source and destination overlap in memcpy(0x5a2005a, 0x5a20058, 8) ==14329== at 0x4C2E13D: memcpy@@GLIBC_2.14 (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==14329== by 0x400DBD: std::char_traits::copy(char*, char const*, unsigned long) (in /home/msebor/tmp/a.out) ==14329== by 0x401407: Traits::copy(char*, char const*, unsigned long) (in /home/msebor/tmp/a.out) ==14329== by 0x4012A6: std::basic_string, std::allocator >::_M_copy(char*, char const*, unsigned long) (in /home/msebor/tmp/a.out) ==14329== by 0x40105B: std::basic_string, std::allocator >::copy(char*, unsigned long, unsigned long) const (in /home/msebor/tmp/a.out) ==14329== by 0x400E54: void f >(char const*, unsigned long) (in /home/msebor/tmp/a.out) ==14329== by 0x400D3D: main (in /home/msebor/tmp/a.out) ==14329== ==14329== ==14329== HEAP SUMMARY: ==14329== in use at exit: 0 bytes in 0 blocks ==14329== total heap usage: 1 allocs, 1 frees, 35 bytes allocated ==14329== ==14329== All heap blocks were freed -- no leaks are possible ==14329== ==14329== For counts of detected and suppressed errors, rerun with: -v ==14329== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 0 from 0) a.out: t.cpp:7: static char* Traits::copy(CharT*, const CharT*, size_t) [with CharT = char; size_t = long unsigned int]: Assertion `d < s || s + n < d' failed. Aborted (core dumped)