[LLVMbugs] [Bug 17148] New: std::string::resize with (max_size - 1) segmentation fault

[bugzilla-daemon at llvm.org]

http://llvm.org/bugs/show_bug.cgi?id=17148

            Bug ID: 17148
           Summary: std::string::resize with (max_size - 1) segmentation
                    fault
           Product: libc++
           Version: unspecified
          Hardware: PC
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: P
         Component: All Bugs
          Assignee: hhinnant at apple.com
          Reporter: ruslan_baratov at yahoo.com
                CC: llvmbugs at cs.uiuc.edu
    Classification: Unclassified

This simple program produce segmentation fault:

#include <string>
#include <stdexcept>

int main() {
  try {
    std::string s;
    s.resize(s.max_size() - 1, 'x');
    return 0;
  }
  catch (std::bad_alloc& exc) {
    return 1;
  }
}

Expected return: 0 or 1 (bad_alloc).

valgrind output:

==35098== Invalid write of size 4
==35098==    at 0x4C2F9BF: memset (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==35098==    by 0x4016AD: std::__1::basic_string<char,
std::__1::char_traits<char>, std::__1::allocator<char> >::append(unsigned long,
char) (string:666)
==35098==    by 0x40115A: std::__1::basic_string<char,
std::__1::char_traits<char>, std::__1::allocator<char> >::resize(unsigned long,
char) (string:3038)
==35098==    by 0x400F68: main (test.cpp:7)

Changing '-libstd=libc++' to '-stdlib=libstdc++' help, return is 1 (bad_alloc).

build from git:
clang: b2c70470def1ab0380be36a295ce4aa7864abfe1
llvm: a83aeae350d822ec84ded34ff3fdf1e0917d3bfd
libcxx: 62f34be0baf276c2b310db8bda0d358841ebab9a

-- 
You are receiving this mail because:
You are on the CC list for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-bugs/attachments/20130907/eef07e5c/attachment.html>