Opened 4 years ago

#13554 new Bugs

NULL deference exception in boost::asio::ip::tcp::resolver::results_type

Reported by: giacomopoz@… Owned by: chris_kohlhoff
Milestone: To Be Determined Component: asio
Version: Boost 1.66.0 Severity: Problem
Keywords: Cc:

Description

boost::asio::ip::tcp::resolver::results_type type triggers a NULL dereference exception when calling empty() on a default-initialized instance.

How to reproduce:

  • instantiate a new boost::asio::ip::tcp::resolver::results_type class instance with the default parameterless constructor
  • call the empty() method, it should return true
  • notice the access violation crash triggered

Code example:

#include <boost/asio/ip/tcp.hpp>

int main(int /*argc*/, char** /*argv*/)
{
  boost::asio::ip::tcp::resolver::results_type test = boost::asio::ip::tcp::resolver::results_type();
  if (test.empty())
    printf("ok");
}

Boost version: 1.66 Windows x64 vc141

Issue analysis: empty() is implemented as

bool empty() const BOOST_ASIO_NOEXCEPT
{
  return this->values_->empty();
}

but this->values_ returns NULL when the class is empty. A possible fix could be to NULL-check this->values_ and then call ->empty() (if still needed at all)

bool empty() const BOOST_ASIO_NOEXCEPT
{
  return !this->values_ || this->values_->empty();
}

Current workaround: I would suggest not to use .empty() at all currently but to rely on .begin() == .end() .

Note that even if the code example above looks quite meaningless, .empty() crashes causes issue for example when checking if an address can be resolved using ip::basic_resolver::resolve function. The documentation states "An empty range is returned if an error occurs" so one expects to be able to check if the range is empty.

P.S.: I had links to sources and documentation but the tracker kept saying "Akismet says content is spam". Please fix your tracker.

Change History (0)

Note: See TracTickets for help on using tickets.