[Bug libstdc++/81891] [5/6/7/8 Regression] heap-use-after-free if inserting element in std::unordered_map(InputIt, InputIt) throws

[redi at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=81891

Jonathan Wakely <redi at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |redi at gcc dot gnu.org

--- Comment #1 from Jonathan Wakely <redi at gcc dot gnu.org> ---
The problem is that the _Hashtable constructor delegates to another
constructor, so if an exception happens in the delegating constructor the
object has been constructed and its destructor will run. The delegating
constructor calls _M_deallocate_buckets() but doesn't zero the _M_buckets
pointer, so the destructor tries to deallocate them again.