[PATCH] libstdc++/7961

[Paolo Carlini]

Hi,

I believe John is right, even if it is difficult to create an
actually seg-faulting testcase. In the following

#include <string>
#include <cassert>

int main()
{
  std::string lhs("abc");

  lhs.push_back('\0');
  lhs += "def";

  assert( lhs != "abc" );
}

operator!= (memcmp, that is) access "abc" past its final '\0',
since lhs.size() == 7 and this value is currently used in
the memcmp() call from compare().

Indeed, John's fix makes compare(const _CharT* __s) consistent
with the current implementation of compare(size_type, size_type,
const _CharT*) in the use of traits_type::length(__s) and min().

Ok to apply?

Ciao, Paolo.

P.S. For Andreas: in v3 there are no risks of overflows in the
final computations of __r since max_size < npos/4.

///////

2002-11-01  John Carter  <john.carter@tait.co.nz>

        PR libstdc++/7961
        * include/bits/basic_string.tcc
        (compare(const _CharT* __s)): Don't access __s past its length.


-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: patch_7961
URL: <http://gcc.gnu.org/pipermail/libstdc++/attachments/20021101/5590c94b/attachment.ksh>