Sun 14 Sep 2008 01:01:22 AM UTC, original submission:
In Element, const char *to_string() const; is presumably intended to return a pointer to the NULL-terminated string containing the value of the string Element type. However, the string is never actually NULL (or zero) terminated.
For example:
The element constructor will call init(string, string), which will in turn call the Buffer(str.size()) constructor, where the argument indicates the number of bytes to allocate. But str.size() is the number of characters in the string, not including the terminating NULL. Buffer::copy(string) is then called, which calls std::copy(str.begin, str.end(), _buf), which copies the characters, but obviously does not append a 0 (and if it did, it would overflow the buffer of size str.size()).
So, subsequently, when one calls Element::to_string(), a pointer to the buffer is returned, which is still not NULL-terminated!
And, in the case of AsValueTest.cpp, tests may or may not succeed depending on your luck. Obviously this could lead to buffer overflows...
Found by setting glibc's MALLOC_CHECK_=2.
|