This is the mail archive of the
gcc-bugs@gcc.gnu.org
mailing list for the GCC project.
[Bug libstdc++/81891] [5/6/7/8 Regression] heap-use-after-free if inserting element in std::unordered_map(InputIt, InputIt) throws
- From: "redi at gcc dot gnu.org" <gcc-bugzilla at gcc dot gnu dot org>
- To: gcc-bugs at gcc dot gnu dot org
- Date: Fri, 18 Aug 2017 16:40:58 +0000
- Subject: [Bug libstdc++/81891] [5/6/7/8 Regression] heap-use-after-free if inserting element in std::unordered_map(InputIt, InputIt) throws
- Auto-submitted: auto-generated
- References: <bug-81891-4@http.gcc.gnu.org/bugzilla/>
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=81891
Jonathan Wakely <redi at gcc dot gnu.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |ASSIGNED
Assignee|unassigned at gcc dot gnu.org |redi at gcc dot gnu.org
--- Comment #1 from Jonathan Wakely <redi at gcc dot gnu.org> ---
The problem is that the _Hashtable constructor delegates to another
constructor, so if an exception happens in the delegating constructor the
object has been constructed and its destructor will run. The delegating
constructor calls _M_deallocate_buckets() but doesn't zero the _M_buckets
pointer, so the destructor tries to deallocate them again.