id,summary,reporter,owner,description,type,status,milestone,component,version,severity,resolution,keywords,cc
13127,out of bound memory access in integer_sort,Jie HE <jie.he.cn@…>,Paul A. Bristow,"I called integer_sort() to sort a data array, found a oob access, and crashed.

check the code, found it occurs in inner_swap_loop. the code is like the following:

target_bin = bins + (rshift(*current, log_divisor) - div_min)


but in the previous code, function spreadsort_rec().
the bin count is calculated by the code with a cast (unsigned):

unsigned bin_count = unsigned(div_max - div_min) + 1;

and the next place in spreadsort_rec()

for (RandomAccessIter current = first; current != last;)
   bin_sizes[unsigned(rshift(*(current++), log_divisor) - div_min)]++;

so that, I thought there is a missing cast (unsigned) in inner_swap_loop().
",Bugs,new,To Be Determined,sort,Boost 1.64.0,Problem,,,