iovisor / iovisor/bcc

Dereferencing iterator pointing to std::map::end in TableStorage leads to undefined behavior

Open
#2,310 1 comment 3 reactions 0 assignees View on GitHub
Dominant language
C
Stars
22.7k
Forks
4.1k
Avg merge
5d 13h
Merged PRs (30d)
3

Description

In https://github.com/iovisor/bcc/blob/79a8e3c1303867a42f3c124b853a894c5b85963a/src/cc/table_storage.cc#L94-L96 The `!=` operator will always de-reference the underlying map iterator. There are times when this iterator will be equal to `std::map::end` and de-referencing `std::map::end` is undefined behavior (according to **https://en.cppreference.com/w/cpp/container/map/end**).

For example, ` TableStorage::DeletePrefix`

https://github.com/iovisor/bcc/blob/79a8e3c1303867a42f3c124b853a894c5b85963a/src/cc/table_storage.cc#L41-L48

is called in the `BPFModule` destructor, in this function the operation `it != upper` will lead to de-referencing of a `std::map::end` iterator for an empty table (the table is empty for a default constructed `ebpf::BPF` object).

Is this design intended for some reason? Or perhaps I'm missing something?

Contributor guide

No contributing guide indexed for this repository

Research direction

Read src/cc/table_storage.cc around DeletePrefix (lines 41-48) and the iterator comparison at lines 94-96, then trace the BPFModule destructor path described in the issue. Reproduce the empty-table case with a default-constructed ebpf::BPF object and verify that the iterator comparison no longer dereferences std::map::end.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
devtools, operating-systems
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.