Dereferencing iterator pointing to std::map::end in TableStorage leads to undefined behavior
- Dominant language
- C
- Stars
- 22.7k
- Forks
- 4.1k
- Avg merge
- 5d 13h
- Merged PRs (30d)
- 3
Description
In https://github.com/iovisor/bcc/blob/79a8e3c1303867a42f3c124b853a894c5b85963a/src/cc/table_storage.cc#L94-L96 The `!=` operator will always de-reference the underlying map iterator. There are times when this iterator will be equal to `std::map::end` and de-referencing `std::map::end` is undefined behavior (according to **https://en.cppreference.com/w/cpp/container/map/end**).
For example, ` TableStorage::DeletePrefix`
https://github.com/iovisor/bcc/blob/79a8e3c1303867a42f3c124b853a894c5b85963a/src/cc/table_storage.cc#L41-L48
is called in the `BPFModule` destructor, in this function the operation `it != upper` will lead to de-referencing of a `std::map::end` iterator for an empty table (the table is empty for a default constructed `ebpf::BPF` object).
Is this design intended for some reason? Or perhaps I'm missing something?
Contributor guide
No contributing guide indexed for this repository
Research direction
Read src/cc/table_storage.cc around DeletePrefix (lines 41-48) and the iterator comparison at lines 94-96, then trace the BPFModule destructor path described in the issue. Reproduce the empty-table case with a default-constructed ebpf::BPF object and verify that the iterator comparison no longer dereferences std::map::end.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- devtools, operating-systems
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100