[LLVMbugs] [Bug 15667] New: crash in search_n

bugzilla-daemon at llvm.org bugzilla-daemon at llvm.org
Thu Apr 4 07:17:59 PDT 2013


            Bug ID: 15667
           Summary: crash in search_n
           Product: libc++
           Version: unspecified
          Hardware: Macintosh
                OS: All
            Status: NEW
          Severity: normal
          Priority: P
         Component: All Bugs
          Assignee: hhinnant at apple.com
          Reporter: dlorenz at mac.com
                CC: llvmbugs at cs.uiuc.edu
    Classification: Unclassified


This code crashes in Xcode 4.6.1:
int main(int argc, char *argv[])
  // Crashes
  std::vector<uint8_t> bs{1, 0, 0};
  std::search_n(bs.begin(), bs.end(), 3, 1);

  // Does not crash
  std::vector<uint8_t> bs{1, 0};
  std::search_n(bs.begin(), bs.end(), 2, 1);

  return 0;

The problem lies in __search_n, when a partial match is made, __first will be
beyond __s and the check for equality will fail, so there is no early exit;
eventually it will crash.

if (__first == __s)  // return __last if no element matches __value_

needs to be replaced by

if (__first >= __s)  // return __last if no element matches __value_

You are receiving this mail because:
You are on the CC list for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-bugs/attachments/20130404/867279b3/attachment.html>

More information about the llvm-bugs mailing list