This is the mail archive of the
gcc-bugs@gcc.gnu.org
mailing list for the GCC project.
[Bug libstdc++/58415] __sso_string_base move constructor does not null terminate local data when moving from empty string
- From: "mkirzinger at gmail dot com" <gcc-bugzilla at gcc dot gnu dot org>
- To: gcc-bugs at gcc dot gnu dot org
- Date: Fri, 13 Sep 2013 17:26:38 +0000
- Subject: [Bug libstdc++/58415] __sso_string_base move constructor does not null terminate local data when moving from empty string
- Auto-submitted: auto-generated
- References: <bug-58415-4 at http dot gcc dot gnu dot org/bugzilla/>
http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58415
--- Comment #2 from Michael Kirzinger <mkirzinger at gmail dot com> ---
There appears to be one additional problem: if __rcs._M_is_local() is true, but
__rcs._M_length() is false, the buffer of the string being created is never
null terminated/zeroed.
Example:
----------------------------------------------------------
#include <ext/vstring.h>
#include <cstdio>
#include <cstdlib>
#include <cstring>
typedef __gnu_cxx::__versa_string<char> string;
int main()
{
char buf[sizeof(string)+1] = "stringstringstring";
string s1;
string* s2 = new (buf) string(std::move(s1));
printf("%s\n", s2->c_str());
}