[llvm-bugs] [Bug 49923] New: Swapping a closed filebuf runs into undefined behavior

[via llvm-bugs]

https://bugs.llvm.org/show_bug.cgi?id=49923

            Bug ID: 49923
           Summary: Swapping a closed filebuf runs into undefined behavior
           Product: libc++
           Version: 11.0
          Hardware: All
                OS: All
            Status: NEW
          Severity: normal
          Priority: P
         Component: All Bugs
          Assignee: unassignedclangbugs at nondot.org
          Reporter: alex at grundis.de
                CC: llvm-bugs at lists.llvm.org, mclow.lists at gmail.com

In the following Code UBsan is triggered:

        std::ofstream f_old(filename);
        assert(f_old << "Hello ");

        std::ofstream f_new(filename2);
        assert(f_new << "Foo ");

        // After swapping both are valid and where they left
        f_new.swap(f_old);
        assert(f_old << "Bar");
        assert(f_new << "World");

        f_new.close();
        swap(f_new, f_old);

The problem is as follows:
- __extbuf_ is set to some buffer
- during operation of the filebug __extbufnext_ and __extbufend_ are set
relative to that
- filebuf.close calls setbuf(0, 0) which ends up setting __extbuf_ to the
internal min buffer:
https://github.com/llvm/llvm-project/blob/82e537a9d28a2c18bd1637e2eac0e0af658ed829/libcxx/include/fstream#L896
- Note that it does not reset the next/end members
- filebuf.swap then uses the difference between __extbufnext_/__extbufend_  to
__extbuf_  which is invalid as they don't point to the same memory anymore:
https://github.com/llvm/llvm-project/blob/release/12.x/libcxx/include/fstream#L428-L429
- This then triggers UBsan in the following pointer addition with that invalid
offset:
https://github.com/llvm/llvm-project/blob/release/12.x/libcxx/include/fstream#L442-L445

-- 
You are receiving this mail because:
You are on the CC list for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-bugs/attachments/20210411/7664bd71/attachment.html>