boost::uuids::string_generator accepts garbage input

[Jim King <jim.king@…>]

One can pass a string in such as "01234567-89ab-cdef-0123456789abcdef-FOO" to boost::uuids::string_generator for construction and it will happily turn everything before the trailing non-guid information "-FOO" into a Guid, and not throw an exception. This appears to be a problem in not checking the end iterator at the end of operator()(iter, iter) before returning; at that point it should equal end(), otherwise there is garbage appended to the input.

The same code exists up through boost 1.58 in the string_generator.

[Jim King <jim.king@…>]

Here's a patch that resolves the issue:

--- a/boost/uuid/string_generator.hpp
+++ b/boost/uuid/string_generator.hpp
@@ -104,6 +104,11 @@ struct string_generator {
             check_close_brace(c, open_brace_char);
         }
         
+        // Boost Trac 11482 - detect trailing garbage or unexpected data
+        if (begin != end) {
+            throw_invalid();
+        }
+
         return u;
     }

[James E. King, III <jking@…>]

Pull request out: see ​https://github.com/boostorg/uuid/pull/17