libstdc++/3946: auto_ptr_ref constructor allows dangerous conversion

[theonetruekenny@yahoo.com]

>Number:         3946
>Category:       libstdc++
>Synopsis:       auto_ptr_ref constructor allows dangerous conversion
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    unassigned
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sun Aug 05 15:26:00 PDT 2001
>Closed-Date:
>Last-Modified:
>Originator:     Kenny Simpson
>Release:        online compiler (gcc version 3.0.1 20010626 (prerelease)) and 8-05-2001 CVS
>Organization:
>Environment:
online compiler
>Description:
auto_ptr_ref<T>'s constructor  allows conversion from  T*.
auto_ptr<U> has a member operator=( auto_ptr_ref<T>).
This effectively adds a member operator=(T*) to auto_ptr.

I believe this to be neither intentional, nor desirable.
>From http://anubis.dkuug.dk/jtc1/sc22/wg21/docs/lwg-defects.html#127
:

auto_ptr& operator=(auto_ptr_ref<X> r) throw()
	Effects: Calls reset(p.release()) for the auto_ptr p that r holds a 
	reference to.
	Returns: *this. 

This implies that auto_ptr_ref's must have an associated auto_ptr, but allowing an auto_ptr_ref to be constructed for any pointer defeats this.
>How-To-Repeat:
#include <memory>

int main()
{
  std::auto_ptr<int> a;
  int* b = new int(3);
  a = b; // this should NOT compile
  return 0;
}
>Fix:
on line 62 of include/bits/std_memory.h change:
   auto_ptr_ref(_Tp1* __p) : _M_ptr(__p) {}
to
   explicit auto_ptr_ref(_Tp1* __p) : _M_ptr(__p) {}
>Release-Note:
>Audit-Trail:
>Unformatted: