[LLVMbugs] [Bug 15667] New: crash in search_n

[bugzilla-daemon at llvm.org]

http://llvm.org/bugs/show_bug.cgi?id=15667

            Bug ID: 15667
           Summary: crash in search_n
           Product: libc++
           Version: unspecified
          Hardware: Macintosh
                OS: All
            Status: NEW
          Severity: normal
          Priority: P
         Component: All Bugs
          Assignee: hhinnant at apple.com
          Reporter: dlorenz at mac.com
                CC: llvmbugs at cs.uiuc.edu
    Classification: Unclassified

See
http://stackoverflow.com/questions/15809929/is-this-crash-in-libc-stdsearch-n-a-bug

This code crashes in Xcode 4.6.1:
int main(int argc, char *argv[])
{
  // Crashes
  std::vector<uint8_t> bs{1, 0, 0};
  std::search_n(bs.begin(), bs.end(), 3, 1);

  // Does not crash
  std::vector<uint8_t> bs{1, 0};
  std::search_n(bs.begin(), bs.end(), 2, 1);

  return 0;
}

The problem lies in __search_n, when a partial match is made, __first will be
beyond __s and the check for equality will fail, so there is no early exit;
eventually it will crash.

if (__first == __s)  // return __last if no element matches __value_

needs to be replaced by

if (__first >= __s)  // return __last if no element matches __value_

-- 
You are receiving this mail because:
You are on the CC list for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-bugs/attachments/20130404/867279b3/attachment.html>