UB in std::vector<bool> constructors (read of uninitialized memory)
- Dominant language
- LLVM
- Stars
- 40.5k
- Forks
- 18.7k
- PR merge metrics
- PR metrics pending
Description
Some `std::vector` constructors read uninitialized memory.
They call __vallocate, which calls new, but doesn't zero the allocated buffer. Constructors then use std::fill_n and std::copy, which in turns sets bit by bit. Since storing a bit involving reading the byte first, this operations ends up reading uninitialized memory.
This simple example clearly shows the loads directly from the new operator: https://gcc.godbolt.org/z/vKaPnfT5M
cross ref (libstdc++ has the same bug): https://gcc.gnu.org/bugzilla/show_bug.cgi?id=122506
Contributor guide
Research direction
Start by reproducing the linked Compiler Explorer example, then trace the std::vector constructors through __vallocate, std::fill_n, and std::copy. Done means the constructors no longer read uninitialized memory; the issue does not name a specific file or regression test to run.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- compilers
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100