https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65113
Bug ID: 65113
Summary: string::copy violates traits requirements
Product: gcc
Version: 4.9.2
Status: UNCONFIRMED
Severity: normal
Priority: P3
Component: libstdc++
Assignee: unassigned at gcc dot gnu.org
Reporter: msebor at gmail dot com
libstdc++ string goes to quite a bit of trouble to avoid self-modifying calls
that could potentially corrupt the controlled sequence but there is at least
one case that has escaped this treatment. The test case below shows that
basic_string::copy(char*, size_t) calls char_traits::copy with arguments that
violate the preconditions on the function. That function in turn calls memcpy
with arguments that violate its own constraints.
I suspect that this use case may not have been intended when string was
designed. It might be perhaps be worth checking with the LWG to see if
basic_string::copy should require the argument to be distinct from the object
on which it's called.
$ cat t.cpp && for dbg in -DNDEBUG ""; do g++ $dbg -Wall t.cpp && ./a.out &&
valgrind ./a.out; done
#include <assert.h>
#include <string>
template <class CharT>
struct Traits: std::char_traits<CharT> {
static char* copy (CharT *d, const CharT *s, size_t n) {
assert (d < s || s + n < d);
return std::char_traits<CharT>::copy (d, s, n);
}
};
template <class CharT, class Traits>
void f (const CharT *a, size_t len)
{
typedef std::basic_string<CharT, Traits> String;
String str (a, len);
CharT* const s = &str [2];
const typename String::size_type n = str.size () - 2;
str.copy (s, n, 0);
}
int main ()
{
const char S[] = "0123456789";
f<char, Traits<char> >(S, sizeof S - 1);
}
==14329== Memcheck, a memory error detector
==14329== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al.
==14329== Using Valgrind-3.10.1 and LibVEX; rerun with -h for copyright info
==14329== Command: ./a.out
==14329==
==14329== Source and destination overlap in memcpy(0x5a2005a, 0x5a20058, 8)
==14329== at 0x4C2E13D: memcpy@@GLIBC_2.14 (in
/usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==14329== by 0x400DBD: std::char_traits<char>::copy(char*, char const*,
unsigned long) (in /home/msebor/tmp/a.out)
==14329== by 0x401407: Traits<char>::copy(char*, char const*, unsigned long)
(in /home/msebor/tmp/a.out)
==14329== by 0x4012A6: std::basic_string<char, Traits<char>,
std::allocator<char> >::_M_copy(char*, char const*, unsigned long) (in
/home/msebor/tmp/a.out)
==14329== by 0x40105B: std::basic_string<char, Traits<char>,
std::allocator<char> >::copy(char*, unsigned long, unsigned long) const (in
/home/msebor/tmp/a.out)
==14329== by 0x400E54: void f<char, Traits<char> >(char const*, unsigned
long) (in /home/msebor/tmp/a.out)
==14329== by 0x400D3D: main (in /home/msebor/tmp/a.out)
==14329==
==14329==
==14329== HEAP SUMMARY:
==14329== in use at exit: 0 bytes in 0 blocks
==14329== total heap usage: 1 allocs, 1 frees, 35 bytes allocated
==14329==
==14329== All heap blocks were freed -- no leaks are possible
==14329==
==14329== For counts of detected and suppressed errors, rerun with: -v
==14329== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 0 from 0)
a.out: t.cpp:7: static char* Traits<CharT>::copy(CharT*, const CharT*, size_t)
[with CharT = char; size_t = long unsigned int]: Assertion `d < s || s + n < d'
failed.
Aborted (core dumped)
