https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94906
Bug ID: 94906
Summary: memory corruption in std::pmr::memory_buffer_resource
Product: gcc
Version: unknown
Status: UNCONFIRMED
Severity: normal
Priority: P3
Component: libstdc++
Assignee: unassigned at gcc dot gnu.org
Reporter: arnaud02 at users dot sourceforge.net
Target Milestone: ---
>cat pmr1.cpp
#include <array>
#include <memory_resource>
#include <unordered_map>
int main() {
const std::size_t max_size = 75'000'000;
std::pmr::monotonic_buffer_resource res;
std::pmr::unordered_map<int, std::array<char,32>> counter{&res};
for (size_t i = 0; i < max_size; ++i) counter[i];
}
>g++ -Wall -std=c++17 -O2 -g pmr1.cpp && ./a.out
*** Error in `./a.out': free(): invalid pointer: 0x00002b06379d000f ***
======= Backtrace: =========
/lib64/libc.so.6(+0x81299)[0x2b03c8a6f299]
opt/gcc/gcc-930-rh7/lib64/libstdc++.so.6(_ZNSt3pmr25monotonic_buffer_resource18_M_release_buffersEv+0x48)[0x2b03c825fe78]
opt/gcc/gcc-930-rh7/lib64/libstdc++.so.6(_ZNSt3pmr25monotonic_buffer_resourceD2Ev+0x1e)[0x2b03c825febe]
./a.out[0x400d51]
/lib64/libc.so.6(__libc_start_main+0xf5)[0x2b03c8a10555]
./a.out[0x400eb4]
In monotonic_buffer_resource::_Chunk::release, "__size" is not calculated
properly when _Chunk::_M_size is 32 or more. Here is a candidate patch:
--- gcc-9.3.0/libstdc++-v3/src/c++17/memory_resource.cc 2020-03-12
11:07:24.000000000 +0000
+++ gcc-9.3.0/libstdc++-v3/src/c++17/memory_resource.cc.new 2020-05-01
18:31:24.367672036 +0100
@@ -228,7 +228,7 @@
if (__ch->_M_canary != (__ch->_M_size | __ch->_M_align))
return; // buffer overflow detected!
- size_t __size = (1u << __ch->_M_size);
+ size_t __size = (1lu << __ch->_M_size);
size_t __align = (1u << __ch->_M_align);
void* __start = (char*)(__ch + 1) - __size;
__r->deallocate(__start, __size, __align);
