Skip to content

Commit

Permalink
Fix use-after-free in DynamicTruncation::preliminaryFit
Browse files Browse the repository at this point in the history
On the first iteration we used end() of STL container. end() returns
a pointer after the last element in container. In this case, we were
starting iteration from the last __removed__ `TrackingRecHit`.

Signed-off-by: David Abdurachmanov <David.Abdurachmanov@cern.ch>
  • Loading branch information
David Abdurachmanov authored and David Abdurachmanov committed May 26, 2015
1 parent 9d48882 commit af475f9
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion RecoMuon/GlobalTrackingTools/src/DynamicTruncation.cc
Original file line number Diff line number Diff line change
Expand Up @@ -387,7 +387,7 @@ void DynamicTruncation::preliminaryFit(map<int, vector<DetId> > compatibleIds, m
}
}
if (!prelFitMeas.empty()) prelFitMeas.pop_back();
for (ConstRecHitContainer::const_iterator imrh = prelFitMeas.end(); imrh != prelFitMeas.begin(); imrh-- ) {
for (auto imrh = prelFitMeas.rbegin(); imrh != prelFitMeas.rend(); ++imrh) {
DetId id = (*imrh)->geographicalId();
TrajectoryStateOnSurface tmp = propagatorPF->propagate(prelFitState, theG->idToDet(id)->surface());
if (tmp.isValid()) prelFitState = tmp;
Expand Down

0 comments on commit af475f9

Please sign in to comment.