Opened 9 years ago

Closed 9 years ago

#9335 closed Bugs (fixed)

default constructed split_iterator has UB when copy constructed

Reported by: nlewycky@… Owned by: Marshall Clow
Milestone: To Be Determined Component: string_algo
Version: Boost Development Trunk Severity: Problem
Keywords: split_iterator Cc: gromer@…

Description

The copy constructor for split_iterator is:

            split_iterator( const split_iterator& Other ) :
                base_type(Other),
                m_Match(Other.m_Match),
                m_Next(Other.m_Next),
                m_End(Other.m_End),
                m_bEof(Other.m_bEof)
            {}

Note that the member copies in the constructor initializer list perform lvalue-to-rvalue conversion. That has undefined behaviour when the value is uninitialized.

The default constructor is implemented as so:

            split_iterator() {}

This means that if you default-construct a split_iterator then try to copy it, the copy ctor will exhibit undefined behaviour. I think this was intended to be valid, all default-constructed split_iterators compare equal.

The two possible fixes are to either change the default constructor to initialize the four members, or to change the copy constructor to use memcpy to copy the value representation instead of the object representation (I haven't checked whether all the members are trivially copyable).

Attachments (1)

ticket-9335-1.patch (941 bytes ) - added by nlewycky@… 9 years ago.
proposed fix

Download all attachments as: .zip

Change History (6)

comment:1 by gromer@…, 9 years ago

Cc: gromer@… added

comment:2 by Marshall Clow, 9 years ago

Status: newassigned

comment:3 by Marshall Clow, 9 years ago

I believe all that's necessary here is to initialize m_bEof in the default constructor.

All the other members have default constructors (i.e, are not PODs), so they will be initialized.

by nlewycky@…, 9 years ago

Attachment: ticket-9335-1.patch added

proposed fix

comment:4 by Marshall Clow, 9 years ago

(In [86583]) Fix an uninitialized member in a default-initialized split_iterator; Refs #9335

comment:5 by Marshall Clow, 9 years ago

Resolution: fixed
Status: assignedclosed

Merged to master in cf249c090c3021faebbcf5f6cf5574ce258aa7f6.

Note: See TracTickets for help on using tickets.