[Bug libstdc++/117121] [15 regression] heap-buffer-overflow in ranges::{copy,move}_backward for 1-element ranges

[redi at gcc dot gnu.org via Gcc-bugs]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=117121

Jonathan Wakely <redi at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
   Target Milestone|---                         |15.0
   Last reconfirmed|                            |2024-10-13
           Assignee|unassigned at gcc dot gnu.org      |redi at gcc dot gnu.org
             Status|UNCONFIRMED                 |ASSIGNED

--- Comment #1 from Jonathan Wakely <redi at gcc dot gnu.org> ---
I've just fixed this locally.

index 40c628b3818..3c8d46198c5 100644
--- a/libstdc++-v3/include/bits/ranges_algobase.h
+++ b/libstdc++-v3/include/bits/ranges_algobase.h
@@ -418,12 +418,13 @@ namespace ranges
                {
                  using _ValueTypeI = iter_value_t<_Iter>;
                  auto __num = __last - __first;
+                 __result -= __num;
                  if (__num > 1) [[likely]]
-                   __builtin_memmove(__result - __num, __first,
+                   __builtin_memmove(__result, __first,
                                      sizeof(_ValueTypeI) * __num);
                  else if (__num == 1)
                    ranges::__assign_one<_IsMove>(__first, __result);
-                 return {__first + __num, __result - __num};
+                 return {__first + __num, __result};
                }
            }