Skip to content

Commit

Permalink
[io] Protect out-of-bounds access in R__WriteDestructorBody:
Browse files Browse the repository at this point in the history
Fixes assert in roottest/root/meta/MakeProject/runcms310.C
```
/builddir/build/BUILD/gcc-8.3.1-20190223/obj-x86_64-redhat-linux/x86_64-redhat-linux/libstdc++-v3/include/bits/basic_string.h:1067: std::__cxx11::basic_string<_CharT, _Traits, _Alloc>::reference std::__cxx11::basic_string<_CharT, _Traits, _Alloc>::operator[](std::__cxx11::basic_string<_CharT, _Traits, _Alloc>::size_type) [with _CharT = char; _Traits = std::char_traits<char>; _Alloc = std::allocator<char>; std::__cxx11::basic_string<_CharT, _Traits, _Alloc>::reference = char&; std::__cxx11::basic_string<_CharT, _Traits, _Alloc>::size_type = long unsigned int]: Assertion '__pos <= size()' failed.
    at /mnt/build/wsincrmaster/LABEL/ROOT-fedora29/SPEC/python3/root/io/io/src/TStreamerInfo.cxx:3531
    subClasses=0x7fffffff8db0, top=true)
    at /mnt/build/wsincrmaster/LABEL/ROOT-fedora29/SPEC/python3/root/io/io/src/TStreamerInfo.cxx:3772
    subClasses=0x7fffffff8db0, extrainfos=0x7fffffff9210)
    at /mnt/build/wsincrmaster/LABEL/ROOT-fedora29/SPEC/python3/root/io/io/src/TStreamerInfo.cxx:3976
    at /mnt/build/wsincrmaster/LABEL/ROOT-fedora29/SPEC/python3/root/io/io/src/TFile.cxx:2843
```

where

```
(gdb) p inside
$1 = std::vector of length 3, capacity 4 = {"std::vector", "std::pair<edm::BranchKey,edm::BranchDescription>", ""}
```
  • Loading branch information
Axel-Naumann committed May 18, 2020
1 parent 46303d6 commit 97c62d4
Showing 1 changed file with 2 additions and 1 deletion.
3 changes: 2 additions & 1 deletion io/io/src/TStreamerInfo.cxx
Expand Up @@ -3528,7 +3528,8 @@ static void R__WriteDestructorBody(FILE *file, TIter &next)
std::vector<std::string> inside;
int nestedLoc;
TClassEdit::GetSplit(enamebasic, inside, nestedLoc, TClassEdit::kLong64);
if (inside[1][inside[1].size()-1]=='*' || inside[2][inside[2].size()-1]=='*') {
if ((!inside[1].empty() && inside[1][inside[1].size()-1]=='*')
|| (!inside[2].empty() && inside[2][inside[2].size()-1]=='*')) {
fprintf(file," std::for_each( (%s %s).rbegin(), (%s %s).rend(), DeleteObjectFunctor() );\n",prefix,ename,prefix,ename);
}
}
Expand Down

0 comments on commit 97c62d4

Please sign in to comment.