boostorg/container
1
0
Fork 1
mirror of https://github.com/boostorg/container.git synced 2025-08-01 13:34:30 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix invalid multiallocation_chain iterator increment after memory was overwritten.

Browse Source
This commit is contained in:
Ion Gaztañaga
2018-09-29 09:57:36 +02:00
parent 92e5ffb151
commit c0a1c5cfc0
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
include/boost/container/detail/node_alloc_holder.hpp
View File

@@ -349,10 +349,11 @@ struct node_alloc_holder
dtl::scoped_destructor<NodeAlloc> sdestructor(nalloc, 0);
while(n){
--n;
p = boost::movelib::iterator_to_raw_pointer(itbeg);
++itbeg; //Increment iterator before overwriting pointed memory
//This does not throw
p = ::new(boost::movelib::iterator_to_raw_pointer(itbeg), boost_container_new_t()) Node;
p = ::new(p, boost_container_new_t()) Node;
node_deallocator.set(p);
++itbeg;
//This can throw
boost::container::construct_in_place(nalloc, p->get_real_data_ptr(), beg);
sdestructor.set(p);