Boost C++ Libraries: Ticket #11150: string_ref::to_string is necessarily UB for a default-constructed string_ref, despite stating no preconditions https://svn.boost.org/trac10/ticket/11150 <p> Consider: </p> <pre class="wiki">boost::string_ref foo; auto bar = foo.to_string(); </pre><p> As currently specified (<code>to_string</code> is not documented but in the code it seems to share the semantics of explicit string conversion, which is defined by the reference material, N3442), this invokes <code>std::string::string(nullptr, 0)</code>, which has UB because one of the preconditions of that <code>std::string</code> constructor is that the pointer not be <code>nullptr</code> or <code>NULL</code>... and default-constructing <code>boost::string_ref</code> indeed sets the relevant pointer to <code>NULL</code>. </p> <p> This has been fixed in newer versions of the proposal, e.g. by N3762 (seemingly accidentally): </p> <blockquote class="citation"> <p> Returns: <code>basic_string&lt;charT, traits, Allocator&gt;(str.begin(), str.end(), a)</code> </p> </blockquote> <p> <em>Boost.<a class="missing wiki">StringRef</a></em> should be updated to make the same change, otherwise invoking <code>.to_string()</code> on a default-constructed <code>boost::to_string</code> has undefined behaviour, despite there being no preconditions specified on <code>.to_string()</code>. </p> <p> Alternatively it could be documented that <code>.to_string()</code>'s precondition is that the <code>string_ref</code> actually refers to a string. </p> <p> (Thanks to Mgetz and Luc Danton on Stack Overflow for help identifying this bug.) </p> <p> (I tried to link to references but Trac thought I was a spammer and the Captcha did not show up.) </p> en-us Boost C++ Libraries /htdocs/site/boost.png https://svn.boost.org/trac10/ticket/11150 Trac 1.4.3 Marshall Clow Sat, 28 Mar 2015 18:56:01 GMT <link>https://svn.boost.org/trac10/ticket/11150#comment:1 </link> <guid isPermaLink="false">https://svn.boost.org/trac10/ticket/11150#comment:1</guid> <description> <p> Interestingly enough, this section of the standard <code>[string.cons]</code> has changed over time. </p> <p> Specifically the bit about this constructor: </p> <blockquote> <p> <code>basic_string(const charT* s, size_type n, const Allocator&amp; a = Allocator());</code> </p> </blockquote> <p> C++03 and C++11 have the following requirement: "Requires: s shall not be a null pointer and n &lt; npos" </p> <p> C++14 says instead: "Requires: s points to an array of at least n elements of charT." </p> <p> <code>{ NULL, 0 }</code> is allowable in the second case, but not in the first. </p> </description> <category>Ticket</category> </item> <item> <dc:creator>Marshall Clow</dc:creator> <pubDate>Sat, 28 Mar 2015 19:07:55 GMT</pubDate> <title>status changed; resolution set https://svn.boost.org/trac10/ticket/11150#comment:2 https://svn.boost.org/trac10/ticket/11150#comment:2 <ul> <li><strong>status</strong> <span class="trac-field-old">new</span> → <span class="trac-field-new">closed</span> </li> <li><strong>resolution</strong> → <span class="trac-field-new">fixed</span> </li> </ul> <p> Committed 13610caa36edcae896f59246a2933ef4772690f4 to fix this. </p> Ticket Tomalak Geret'kal Sat, 28 Mar 2015 23:16:37 GMT <link>https://svn.boost.org/trac10/ticket/11150#comment:3 </link> <guid isPermaLink="false">https://svn.boost.org/trac10/ticket/11150#comment:3</guid> <description> <p> I disagree. There is such a thing as an array of [at least] 0 elements of <code>charT</code>: </p> <pre class="wiki">char* ptr = new char[0]; delete[] ptr; </pre><p> and a NULL pointer cannot ever point to such an array. It doesn't point to anything. </p> </description> <category>Ticket</category> </item> <item> <dc:creator>Tomalak Geret'kal</dc:creator> <pubDate>Sat, 28 Mar 2015 23:24:32 GMT</pubDate> <title/> <link>https://svn.boost.org/trac10/ticket/11150#comment:4 </link> <guid isPermaLink="false">https://svn.boost.org/trac10/ticket/11150#comment:4</guid> <description> <p> Thanks for fixing, anyway. :) </p> <p> (Please note that, as you can see, I'm having real difficulty with Trac at the moment. Submissions take a good minute and one appeared to fail but then apparently succeeded. And led to two "comment 3"s?!) </p> </description> <category>Ticket</category> </item> </channel> </rss>