-
Notifications
You must be signed in to change notification settings - Fork 113
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
buffer overflow in boost::container::flat_map on FreeBSD #97
Comments
It looks like this will be fixed in libc++: https://bugs.llvm.org/show_bug.cgi?id=40230 |
Thanks for the report. This nasty pair class was used to portably support all compilers (including C++03 compilers, where std::pair had no move semantics or placement constructors.) One workaround is to embed an internal std::pair inside the dtl::pair class to guarantee excatly the same memory layout. The second step would be to use the native std::pair on compilers withou full C++11 support. I'll try the first workaround in the following days and inform about progress in this bug. |
The first workaround is not possible because pair exposes "first" and "second" as public members. We can try to reproduce the padding in libcpp with the following patch. Could please test it, as I haven't been able to set up the virtual machine yet? |
Thanks for the patch. Unfortunately I'm getting the following error:
Regarding the patch, I would like to suggest to check for |
It compiles with EDIT: It was an error on my side. It still doesn't compile with EDIT 2: It looks like a common macro problem, where the comma in |
I've reproduced the problem in Linux using clang -stdlib=libc++ and defining "_LIBCPP_DEPRECATED_ABI_DISABLE_PAIR_TRIVIAL_COPY_CTOR". New patch attached, the patch |
I confirm that the patch fixes the issue, thank you. |
Many thanks for the report and help solving the issue. Fixed in commit: |
There was a typo in the committed patch, corrected with commit: |
Hi everyone,
I found a bug in
boost::container::flat_map
on FreeBSD.System: FreeBSD 12.0
Compiler: Clang 6.0.1 with libc++ (default compiler on FreeBSD)
Boost: master branch on Github
See the following example:
Output:
2, 3, 0
Expected:
1, 2, 3
flat_map
usesboost::container::dtl::pair
internally and uses reinterpret_casts to expose astd::pair
in the iterators, see flat_map.hpp#L66 and flat_map.hpp#L547The problem is that
std::pair
andboost::container::dtl::pair
have a different memory layout!See the following example:
Output:
std::pair
has a weird padding of 1 byte at the beginning. I think this is related to this patch: https://reviews.llvm.org/D25389I think there might be a problem with the base class
__non_trivially_copyable_base
. It looks like the EBO doesn't work properly.I'm not sure what to do to fix this. I think the C++ standard doesn't enforce the layout of
std::pair
to be{first, second}
, so maybe boost shouldn't assume this.To reproduce this, I used the following virtual machine:
https://download.freebsd.org/ftp/releases/VM-IMAGES/12.0-RELEASE/amd64/Latest/
Upstream bug in IKOS: NASA-SW-VnV/ikos#22
The text was updated successfully, but these errors were encountered: