Boost C++ Libraries: Ticket #12604: neither scoped_array nor checked_delete do check for nullptr https://svn.boost.org/trac10/ticket/12604 <p> Hi, I recently ran across a problem where a scoped_array::reset was called with a nullptr argument. As this is not checked within scoped_array::reset or further down the callstack in scoped_array::swap, a checked_delete was called on a nullptr and threw a Segfault. For me, I'd consider this a bug as scoped_array assumes ownership and hence is responsible for delete it's allocated memory. the problem occurred during an ill-posed usage of the boost utf as documented in the file attached. </p> en-us Boost C++ Libraries /htdocs/site/boost.png https://svn.boost.org/trac10/ticket/12604 Trac 1.4.3 anonymous Fri, 11 Nov 2016 10:17:46 GMT attachment set https://svn.boost.org/trac10/ticket/12604 https://svn.boost.org/trac10/ticket/12604 <ul> <li><strong>attachment</strong> → <span class="trac-field-new">test.cpp</span> </li> </ul> Ticket Peter Dimov Fri, 11 Nov 2016 11:09:06 GMT <link>https://svn.boost.org/trac10/ticket/12604#comment:1 </link> <guid isPermaLink="false">https://svn.boost.org/trac10/ticket/12604#comment:1</guid> <description> <p> nullptr is a valid argument for checked_delete, which basically calls delete. Your test case works for me. </p> </description> <category>Ticket</category> </item> <item> <dc:creator>anonymous</dc:creator> <pubDate>Fri, 11 Nov 2016 12:24:53 GMT</pubDate> <title/> <link>https://svn.boost.org/trac10/ticket/12604#comment:2 </link> <guid isPermaLink="false">https://svn.boost.org/trac10/ticket/12604#comment:2</guid> <description> <p> I am lost ... on every machine I tried, the attached code throws a segfault. </p> <pre class="wiki">$ ./test Running 1 test case... *** No errors detected Segmentation fault (core dumped) </pre><p> can you elaborate what you mean that nullptr is a valid argument to checked_delete? looking at the code, I see </p> <pre class="wiki">template&lt;class T&gt; inline void checked_delete(T * x) { // intentionally complex - simplification causes regressions typedef char type_must_be_complete[ sizeof(T)? 1: -1 ]; (void) sizeof(type_must_be_complete); delete x; } template&lt;class T&gt; inline void checked_array_delete(T * x) { typedef char type_must_be_complete[ sizeof(T)? 1: -1 ]; (void) sizeof(type_must_be_complete); delete [] x; } </pre><p> at no point, neither checked_delete nor checked_array_delete actually checks if (x != 0x0). Just wondering if this is expected from the client to checked delete? If yes, then scoped_array should check if the arguments to scoped_array::reset or scoped_array::swap are no 0x0. </p> </description> <category>Ticket</category> </item> <item> <dc:creator>Peter Dimov</dc:creator> <pubDate>Fri, 11 Nov 2016 13:17:15 GMT</pubDate> <title/> <link>https://svn.boost.org/trac10/ticket/12604#comment:3 </link> <guid isPermaLink="false">https://svn.boost.org/trac10/ticket/12604#comment:3</guid> <description> <p> <code>nullptr</code> is a valid argument for <code>delete</code>. There's no need to check. </p> <p> I tried your example with the current <code>develop</code> branch of Boost, it may be fixed. I'll try with 1.62.0. </p> </description> <category>Ticket</category> </item> <item> <dc:creator>anonymous</dc:creator> <pubDate>Fri, 11 Nov 2016 14:07:20 GMT</pubDate> <title/> <link>https://svn.boost.org/trac10/ticket/12604#comment:4 </link> <guid isPermaLink="false">https://svn.boost.org/trac10/ticket/12604#comment:4</guid> <description> <p> my mistake, I shouldn't submit bug reports on a Friday ... I mixed up code versions and thought that boost had a problem. Sorry for the noise and thank you for your patience. </p> </description> <category>Ticket</category> </item> </channel> </rss>