feedc0de/boost_container
1
0
Fork 0
forked from boostorg/container
Code Pull Requests Activity

Fix deallocating never-allocated storage in vector.merge()

Browse Source 
If merge() is called on an empty vector, then priv_merge_in_new_buffer() will
call deallocate() with size 0 on the old (not-yet-allocated) vector storage.
This violates the Allocator requirement that the pointer passed to deallocate()
must have come from a call to allocate() with the same size.

Fix this by checking old_cap against 0, and also add a unit test for this bug.
This commit is contained in:
Roland Dreier
2019-02-23 18:46:06 -08:00
parent 81d78dbefa
commit 1eb591e85c
2 changed files with 50 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
include/boost/container/vector.hpp
+3 -1
View File
@@ -2373,7 +2373,9 @@ private:
pointer const old_p = this->m_holder.start();
size_type const old_cap = this->m_holder.capacity();
boost::container::destroy_alloc_n(a, boost::movelib::to_raw_pointer(old_p), old_size);
this->m_holder.deallocate(old_p, old_cap);
if (old_cap > 0) {
this->m_holder.deallocate(old_p, old_cap);
}
this->m_holder.m_size = old_size + added;
this->m_holder.start(new_storage);
this->m_holder.capacity(new_cap);