https://svn.boost.org/trac10/ticket/13127 <p> I called integer_sort() to sort a data array, found a oob access, and crashed. </p> <p> check the code, found it occurs in inner_swap_loop. the code is like the following: </p> <p> target_bin = bins + (rshift(*current, log_divisor) - div_min) </p> <p> but in the previous code, function spreadsort_rec(). the bin count is calculated by the code with a cast (unsigned): </p> <p> unsigned bin_count = unsigned(div_max - div_min) + 1; </p> <p> and the next place in spreadsort_rec() </p> <p> for (<a class="missing wiki">RandomAccessIter</a> current = first; current != last;) </p> <blockquote> <p> bin_sizes[unsigned(rshift(*(current++), log_divisor) - div_min)]++; </p> </blockquote> <p> so that, I thought there is a missing cast (unsigned) in inner_swap_loop(). </p> en-us /htdocs/site/boost.png https://svn.boost.org/trac10/ticket/13127 Trac 1.4.3