Boost C++ Libraries: Ticket #10493: Since 1.56, any_range with non-reference references can cause UB https://svn.boost.org/trac10/ticket/10493 <p> This must be related to <a class="assigned ticket" href="https://svn.boost.org/trac10/ticket/10360" title="#10360: Bugs: Since 1.56, any_range use static cast of reference instead of implicit ... (assigned)">#10360</a>. This is a regression since 1.55. </p> <p> When using any_range&lt;T, category, T, ptrdiff_t&gt;, mutable dereference() method returns mutable_reference_type_generator&lt;T&gt;::type, which becomes T&amp;. So dereference() returns a dangling reference to an on-the-fly computed value. </p> <p> See attached test case, which works with 1.55, and fails with -fsanitize=address on Clang 3.5 with 1.56. </p> <pre class="wiki">#include &lt;boost/range/any_range.hpp&gt; #include &lt;boost/range/adaptor/transformed.hpp&gt; #include &lt;cmath&gt; #include &lt;iostream&gt; typedef boost::any_range&lt; std::string, boost::forward_traversal_tag, std::string, std::ptrdiff_t &gt; range_t; std::string f(std::string a) { return a + "!"; } int main() { std::vector&lt;std::string&gt; v = {"a", "b"}; range_t r = v | boost::adaptors::transformed(f); for (auto&amp;&amp; a : r) std::cout &lt;&lt; a &lt;&lt; std::endl; return 0; } </pre> en-us Boost C++ Libraries /htdocs/site/boost.png https://svn.boost.org/trac10/ticket/10493 Trac 1.4.3 Paul Omta <p.omta@…> Fri, 19 Dec 2014 14:36:51 GMT cc set https://svn.boost.org/trac10/ticket/10493#comment:1 https://svn.boost.org/trac10/ticket/10493#comment:1 <ul> <li><strong>cc</strong> <span class="trac-author">p.omta@…</span> added </li> </ul> Ticket Neil Groves Mon, 02 Feb 2015 01:15:56 GMT status, milestone changed https://svn.boost.org/trac10/ticket/10493#comment:2 https://svn.boost.org/trac10/ticket/10493#comment:2 <ul> <li><strong>status</strong> <span class="trac-field-old">new</span> → <span class="trac-field-new">assigned</span> </li> <li><strong>milestone</strong> <span class="trac-field-old">To Be Determined</span> → <span class="trac-field-new">Boost 1.58.0</span> </li> </ul> Ticket anonymous Mon, 27 Apr 2015 12:50:24 GMT <link>https://svn.boost.org/trac10/ticket/10493#comment:3 </link> <guid isPermaLink="false">https://svn.boost.org/trac10/ticket/10493#comment:3</guid> <description> <p> Just reproduced it with boost 1.58 after migration from 1.55. I tried to play with it and found how to make it work. </p> <p> Using const std::string instead of std::string, seems fix the problem </p> <pre class="wiki">typedef boost::any_range&lt; std::string, boost::forward_traversal_tag, const std::string, std::ptrdiff_t &gt; range_t; </pre><p> I haven't digged into any_iterator sources but seems it behave differently when Reference is const </p> </description> <category>Ticket</category> </item> <item> <author>kozlov.taras@…</author> <pubDate>Mon, 27 Apr 2015 12:58:58 GMT</pubDate> <title/> <link>https://svn.boost.org/trac10/ticket/10493#comment:4 </link> <guid isPermaLink="false">https://svn.boost.org/trac10/ticket/10493#comment:4</guid> <description> <p> Forget to add email in previous comment </p> </description> <category>Ticket</category> </item> <item> <author>Tobias Reh <treh@…></author> <pubDate>Mon, 07 Sep 2015 13:05:11 GMT</pubDate> <title/> <link>https://svn.boost.org/trac10/ticket/10493#comment:5 </link> <guid isPermaLink="false">https://svn.boost.org/trac10/ticket/10493#comment:5</guid> <description> <p> Still present in 1.59.0 </p> <p> The problem is becoming more visible with MSVC++2015 because the compiler is better in detecting dangling references and emitting errors for them. To hard code those checks, just add the following assert into every <code>dereference()</code> method in range/detail/any_iterator_wrapper.hpp: </p> <div class="wiki-code"><div class="code"><pre><span class="k">static_assert</span><span class="p">(</span> <span class="o">!</span><span class="n">std</span><span class="o">::</span><span class="n">is_lvalue_reference</span><span class="o">&lt;</span><span class="n">reference</span><span class="o">&gt;::</span><span class="n">value</span> <span class="o">||</span> <span class="n">std</span><span class="o">::</span><span class="n">is_lvalue_reference</span><span class="o">&lt;</span><span class="k">decltype</span><span class="p">(</span><span class="o">*</span><span class="n">m_it</span><span class="p">)</span><span class="o">&gt;::</span><span class="n">value</span><span class="p">,</span> <span class="s">&quot;dangling ref&quot;</span> <span class="p">);</span> </pre></div></div><p> A little bit of digging in the headers shows that the problem lies in range/detail/any_iterator_interface.hpp, where any_incrementable_iterator_interface's </p> <div class="wiki-code"><div class="code"><pre><span class="k">typedef</span> <span class="n">Reference</span> <span class="n">reference</span><span class="p">;</span> </pre></div></div><p> was changed in 1.56.0 to </p> <div class="wiki-code"><div class="code"><pre><span class="k">typedef</span> <span class="k">typename</span> <span class="n">mutable_reference_type_generator</span><span class="o">&lt;</span> <span class="n">Reference</span> <span class="o">&gt;::</span><span class="n">type</span> <span class="n">reference</span><span class="p">;</span> </pre></div></div><p> Rolling this back solves the problem for our codebase. Any possibilities of having this fixed soon? </p> </description> <category>Ticket</category> </item> <item> <author>wslcdg@…</author> <pubDate>Tue, 07 Feb 2017 14:21:53 GMT</pubDate> <title>version, milestone changed https://svn.boost.org/trac10/ticket/10493#comment:6 https://svn.boost.org/trac10/ticket/10493#comment:6 <ul> <li><strong>version</strong> <span class="trac-field-old">Boost 1.56.0</span> → <span class="trac-field-new">Boost 1.62.0</span> </li> <li><strong>milestone</strong> <span class="trac-field-old">Boost 1.58.0</span> → <span class="trac-field-new">Boost 1.64.0</span> </li> </ul> <p> Problem still exists boost 1.62 </p> Ticket o.andriyanov@… Fri, 06 Oct 2017 15:17:30 GMT <link>https://svn.boost.org/trac10/ticket/10493#comment:7 </link> <guid isPermaLink="false">https://svn.boost.org/trac10/ticket/10493#comment:7</guid> <description> <p> Still have this bug in 1.64. Adding <code>const</code> to <code>Reference</code> works around the problem but disables move construction. Is there any other workaround? </p> </description> <category>Ticket</category> </item> <item> <author>jeremy.coulon.jrmc@…</author> <pubDate>Thu, 08 Mar 2018 08:44:24 GMT</pubDate> <title/> <link>https://svn.boost.org/trac10/ticket/10493#comment:8 </link> <guid isPermaLink="false">https://svn.boost.org/trac10/ticket/10493#comment:8</guid> <description> <p> Problem still there in boost 1.65.1 </p> <p> Adding const to Reference doesn't workaround the problem (at least on Visual Studio): c:\path\to\boost\1.65.1\include\boost\range\detail\any_iterator_wrapper.hpp(302) : warning C4172: returning address of local variable or temporary </p> </description> <category>Ticket</category> </item> </channel> </rss>