Bug#732042: Buffer overflow in std::nth_element()

2013-12-13 Thread Torsten Paul
Some additional information: This bug also causes a broken OpenSCAD: https://github.com/openscad/openscad/issues/514 I've confirmed the 2 line change in stl_algo.h fixes the OpenSCAD problem. Upstream bug report exists at http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58800 -- Torsten. -- To

Bug#732042: Buffer overflow in std::nth_element()

2013-12-12 Thread Max Kellermann
Package: libstdc++-4.8-dev Version: 4.8.2-1 Severity: important Demo exploit: #include algorithm int main(int argc, char **argv) { static int data[] = {3,5,4,1,0,2}; std::nth_element(data + 0, data + 3, data + 6, std::lessint()); } Crashes: g++ -std=c++11 test.cxx ./a.out