llvm / llvm/llvm-project

UB in std::vector<bool> constructors (read of uninitialized memory)

Open
#165,867 7 comments 0 reactions 0 assignees View on GitHub
libc++
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

Some `std::vector` constructors read uninitialized memory.
They call __vallocate, which calls new, but doesn't zero the allocated buffer. Constructors then use std::fill_n and std::copy, which in turns sets bit by bit. Since storing a bit involving reading the byte first, this operations ends up reading uninitialized memory.

This simple example clearly shows the loads directly from the new operator: https://gcc.godbolt.org/z/vKaPnfT5M

cross ref (libstdc++ has the same bug): https://gcc.gnu.org/bugzilla/show_bug.cgi?id=122506

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the linked Compiler Explorer example, then trace the std::vector constructors through __vallocate, std::fill_n, and std::copy. Done means the constructors no longer read uninitialized memory; the issue does not name a specific file or regression test to run.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
compilers
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.