libstdc++/9069: race condition in libstdc++3 (basic_string.tcc)

[Matthias Klose]

>Number:         9069
>Category:       libstdc++
>Synopsis:       race condition in libstdc++3 (basic_string.tcc)
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    unassigned
>State:          open
>Class:          change-request
>Submitter-Id:   net
>Arrival-Date:   Fri Dec 27 13:46:01 PST 2002
>Closed-Date:
>Last-Modified:
>Originator:     "Carl R. Witty" <cwitty@newtonlabs.com>
>Release:        3.2.1 (Debian) (Debian unstable)
>Organization:
The Debian Project
>Environment:
System: Debian GNU/Linux (unstable)
Architecture: i686
host: i386-linux
Configured with: ../src/configure -v --enable-languages=c,c++,java,f77,proto,pascal,objc,ada --prefix=/usr --mandir=/usr/share/man --infodir=/usr/share/info --with-gxx-include-dir=/usr/include/c++/3.2 --enable-shared --with-system-zlib --enable-nls --without-included-gettext --enable-__cxa_atexit --enable-clocale=gnu --enable-java-gc=boehm --enable-objc-gc i386-linux
Thread model: posix
gcc version 3.2.2 20021212 (Debian prerelease)
>Description:
[ Reported to the Debian BTS as report #140201.
  Please CC 140201@bugs.debian.org on replies.
  Log of report can be found at http://bugs.debian.org/140201 ]
	

[implementation is the same as on the 3.2 branch]

The function basic_string::_M_leak_hard() in basic_string.tcc is not
thread-safe.  The reference count is read with _M_is_shared() and
then written with _M_set_leaked(), non-atomically.  (This is only a
bug if the string class is supposed to be thread-safe.  I haven't found
an explicit statement that it is, but most of the string operations
are written to be thread-safe.)


>How-To-Repeat:
	
>Fix:
	
>Release-Note:
>Audit-Trail:
>Unformatted: