Opened 7 years ago

#11975 new Bugs

Null pointer dereference in boost::filesystem::copy

Reported by: Michael Rasmussen <Michael.Rasmussen@…> Owned by: Beman Dawes
Milestone: To Be Determined Component: filesystem
Version: Boost 1.60.0 Severity: Problem
Keywords: Cc:

Description

When calling the exception version of boost::filesystem::copy a null pointer is dereferenced.

Testcase:

#include <boost/filesystem.hpp>
int main()
{
    boost::filesystem::copy("/does/not/matter", "/neither/does/this");
}

Using the undefined behaviour sanitizer in clang 3.6.2-1 or g++5.2.1 (-fsanitize=undefined) gives the following message:

boost_1_60_0/libs/filesystem/src/operations.cpp:879:40: runtime error: reference binding to null pointer of type 'system::error_code'

Callstack:

#0  boost::filesystem::detail::copy (from=..., to=..., ec=0x0) at boost_1_60_0/libs/filesystem/src/operations.cpp:879
#1  0x0000000000441421 in boost::filesystem::copy (from=..., to=...) at boost_1_60_0/boost/filesystem/operations.hpp:524
#2  0x000000000044013e in main () at boost_filesystem_copy_bug.cpp:5

It does not appear to have been fixed in the trunk version as far as I can tell.

It also seems to be close in kind to #10450, so a review to see if other null pointer dereferences are lurking elsewhere might be in order.

Change History (0)

Note: See TracTickets for help on using tickets.