boostorg / boostorg/process

Incorrect std::equal usage triggers UB, detected by address sanitizer

Open
#122 20 comments 0 reactions 0 assignees View on GitHub
Dominant language
C++
Stars
145
Forks
151
PR merge metrics
No merged PRs in 30d

Description

In environment.hpp, there are several std::equal calls like this:

std::equal(st1.begin(), st1.end(), *p)

`st1` is a string, with user specified content. `p` is a pointer to a character (I surmise, as `auto` is used all over the place), and holds an existing key of `*this` in each iteration.
This usage of equal is incorrect, as it yields to reading invalid data if `size(st1) > strlen(p)`.

Address sanitizer (ASAN) catches the issue. To reproduce:

```
bp::environment e = boost::this_process:environment();
e["foobarbazquxmux"] = "xyz";
```

The issue can be worked around by using the `set` member of the implementation directly:

```
/*bp::environment*/ auto e = boost::this_process:environment();
e.set("foobarbazquxmux", "xyz");
```

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.