diff options
| author | Ian Lance Taylor <iant@google.com> | 2011-05-25 23:09:14 +0000 |
|---|---|---|
| committer | Ian Lance Taylor <ian@gcc.gnu.org> | 2011-05-25 23:09:14 +0000 |
| commit | 2b4e07b814b50a6f5cdf6b10d05117623d8854c9 (patch) | |
| tree | c4e6283a51cca060e1f1e57da5f033aa3fced142 /libstdc++-v3 | |
| parent | 48126bcbc276e1684f96f7c087d69688028cae73 (diff) | |
| download | gcc-2b4e07b814b50a6f5cdf6b10d05117623d8854c9.tar.gz | |
re PR libstdc++/49060 (use of deleted memory in __gnu_cxx::hashtable::erase)
PR libstdc++/49060
* include/backward/hashtable.h (hashtable::erase): Don't crash if
erasing first and another element with a reference to the other
element.
* testsuite/backward/hash_set/49060.cc: New.
From-SVN: r174240
Diffstat (limited to 'libstdc++-v3')
| -rw-r--r-- | libstdc++-v3/ChangeLog | 8 | ||||
| -rw-r--r-- | libstdc++-v3/include/backward/hashtable.h | 15 | ||||
| -rw-r--r-- | libstdc++-v3/testsuite/backward/hash_set/49060.cc | 35 |
3 files changed, 51 insertions, 7 deletions
diff --git a/libstdc++-v3/ChangeLog b/libstdc++-v3/ChangeLog index 7c7758e66ef..2f5b10365b5 100644 --- a/libstdc++-v3/ChangeLog +++ b/libstdc++-v3/ChangeLog @@ -1,3 +1,11 @@ +2011-05-25 Ian Lance Taylor <iant@google.com> + + PR libstdc++/49060 + * include/backward/hashtable.h (hashtable::erase): Don't crash if + erasing first and another element with a reference to the other + element. + * testsuite/backward/hash_set/49060.cc: New. + 2011-05-25 Paolo Carlini <paolo.carlini@oracle.com> * include/bits/random.h (random_device::min, max): Specify constexpr. diff --git a/libstdc++-v3/include/backward/hashtable.h b/libstdc++-v3/include/backward/hashtable.h index 0bcaec4fdc2..91b0c602cec 100644 --- a/libstdc++-v3/include/backward/hashtable.h +++ b/libstdc++-v3/include/backward/hashtable.h @@ -898,13 +898,7 @@ _GLIBCXX_BEGIN_NAMESPACE_VERSION __next = __cur->_M_next; } } - if (_M_equals(_M_get_key(__first->_M_val), __key)) - { - _M_buckets[__n] = __first->_M_next; - _M_delete_node(__first); - ++__erased; - --_M_num_elements; - } + bool __delete_first = _M_equals(_M_get_key(__first->_M_val), __key); if (__saved_slot) { __next = __saved_slot->_M_next; @@ -913,6 +907,13 @@ _GLIBCXX_BEGIN_NAMESPACE_VERSION ++__erased; --_M_num_elements; } + if (__delete_first) + { + _M_buckets[__n] = __first->_M_next; + _M_delete_node(__first); + ++__erased; + --_M_num_elements; + } } return __erased; } diff --git a/libstdc++-v3/testsuite/backward/hash_set/49060.cc b/libstdc++-v3/testsuite/backward/hash_set/49060.cc new file mode 100644 index 00000000000..985cfcf6afd --- /dev/null +++ b/libstdc++-v3/testsuite/backward/hash_set/49060.cc @@ -0,0 +1,35 @@ +// { dg-options "-Wno-deprecated" } + +#include <backward/hashtable.h> +#include <utility> + +struct modulo2_hash +{ + size_t operator()(int const key) const + { + return key % 2; + } +}; + +struct modulo2_eq +{ + bool operator()(int const left, int const right) const + { + return left % 2 == right % 2; + } +}; + +int main() +{ + typedef std::_Select1st<std::pair<int const, int> > extract_type; + typedef + __gnu_cxx::hashtable<std::pair<int const, int>, int, modulo2_hash, + extract_type, modulo2_eq, std::allocator<int> > + table_type; + table_type table(4, modulo2_hash(), modulo2_eq(), extract_type(), + std::allocator<int>()); + + table.insert_equal(std::make_pair(2, 1)); + table_type::iterator it(table.insert_equal(std::make_pair(4, 2))); + table.erase(it->first); +} |