Boost C++ Libraries: Ticket #2521: date_time exceeds array bounds in special_value_from_string https://svn.boost.org/trac10/ticket/2521 <p> gcc-4.3.2 found this with its new -Warray-bounds feature. It took a few minutes to track down even with the compiler pointing in the right direction: </p> <p> In <a class="ext-link" href="https://svn.boost.org/trac/boost/browser/trunk/libs/date_time/src/gregorian/greg_month.cpp#L76"><span class="icon">​</span>https://svn.boost.org/trac/boost/browser/trunk/libs/date_time/src/gregorian/greg_month.cpp#L76</a> an array called special_value_names (defined in <a class="ext-link" href="https://svn.boost.org/trac/boost/browser/trunk/libs/date_time/src/gregorian/greg_names.hpp#L22"><span class="icon">​</span>https://svn.boost.org/trac/boost/browser/trunk/libs/date_time/src/gregorian/greg_names.hpp#L22</a> ) is passed into the function find_match() as array to search. </p> <p> The enumeration constant date_time::<a class="missing wiki">NumSpecialValues</a> (defined in <a class="ext-link" href="https://svn.boost.org/trac/boost/browser/trunk/boost/date_time/special_defs.hpp#L15"><span class="icon">​</span>https://svn.boost.org/trac/boost/browser/trunk/boost/date_time/special_defs.hpp#L15</a> ) is passed to find_match() as the "limit" argument. </p> <p> The find_match() function (defined in <a class="ext-link" href="https://svn.boost.org/trac/boost/browser/trunk/boost/date_time/date_parsing.hpp#L76"><span class="icon">​</span>https://svn.boost.org/trac/boost/browser/trunk/boost/date_time/date_parsing.hpp#L76</a> ) uses "limit" as an "up to and including" bounds on its for() loop for iterating over the array(s). </p> <p> However, the <a class="missing wiki">NumSpecialValues</a> enumeration member has a value of 6 (it follows the 6 valid enum values), and the special_value_names contains only 6 strings (corresponding to those 6 valid enum values). Because find_match() goes "up to and including" its limit, in this instance it can go off the end of the special_value_names array. </p> <p> The documentation on find_match() is ambiguous as to whether or not the "limit" index itself is intended to be referenced, but it is very explicit that date_time::<a class="missing wiki">NumSpecialValues</a> is supposed to be a valid argument for limit. This would seem to imply that the for() loop condition is wrong, except that all the other uses of find_match() use a constrained_value with a max() value that is the maximum desired value. </p> <p> I think the best conclusion here is that passing a "count"-type value (<a class="missing wiki">NumSpecialValues</a>) for a "max"-type value (the more ambiguously named "limit") is incorrect. Thus, the attached patch. </p> en-us Boost C++ Libraries /htdocs/site/boost.png https://svn.boost.org/trac10/ticket/2521 Trac 1.4.3 Brad Spencer <spencer@…> Fri, 21 Nov 2008 02:07:54 GMT attachment set https://svn.boost.org/trac10/ticket/2521 https://svn.boost.org/trac10/ticket/2521 <ul> <li><strong>attachment</strong> → <span class="trac-field-new">patch</span> </li> </ul> Ticket Andrey Semashev Sat, 22 Nov 2008 13:41:20 GMT <link>https://svn.boost.org/trac10/ticket/2521#comment:1 </link> <guid isPermaLink="false">https://svn.boost.org/trac10/ticket/2521#comment:1</guid> <description> <p> Fixed in revision: 49875 </p> </description> <category>Ticket</category> </item> <item> <dc:creator>Andrey Semashev</dc:creator> <pubDate>Sun, 23 Nov 2008 11:14:17 GMT</pubDate> <title>status changed; resolution set https://svn.boost.org/trac10/ticket/2521#comment:2 https://svn.boost.org/trac10/ticket/2521#comment:2 <ul> <li><strong>status</strong> <span class="trac-field-old">new</span> → <span class="trac-field-new">closed</span> </li> <li><strong>resolution</strong> → <span class="trac-field-new">fixed</span> </li> </ul> Ticket