libstdc++: Fix null pointer dereferences in __gnu_cxx::rope
authorJonathan Wakely <jwakely@redhat.com>
Wed, 2 Dec 2020 12:29:00 +0000 (12:29 +0000)
committerJonathan Wakely <jwakely@redhat.com>
Wed, 2 Dec 2020 12:29:00 +0000 (12:29 +0000)
commit74270a546cf75aad5e2db642b4715728d4da7904
tree9d52348504820169d34120da0c74b0528f39d94e
parentd38fbb5a863dfc00631c74a525a908cef620e149
libstdc++: Fix null pointer dereferences in __gnu_cxx::rope

This fixes UBsan errors like:

/usr/include/c++/10/ext/ropeimpl.h:593:9: runtime error: member access within null pointer of type 'struct _RopeRep'
/usr/include/c++/10/ext/ropeimpl.h:593:9: runtime error: member call on null pointer of type 'struct _Rope_rep_base'
/usr/include/c++/10/ext/rope:556:17: runtime error: reference binding to null pointer of type 'struct allocator_type'
/usr/include/c++/10/ext/ropeimpl.h:593:9: runtime error: reference binding to null pointer of type 'struct allocator_type'
/usr/include/c++/10/ext/rope:1700:30: runtime error: member call on null pointer of type 'struct new_allocator'
/usr/include/c++/10/ext/new_allocator.h:105:29: runtime error: member call on null pointer of type 'struct new_allocator'
/usr/include/c++/10/ext/rope:1702:26: runtime error: reference binding to null pointer of type 'const struct allocator'
/usr/include/c++/10/bits/allocator.h:148:34: runtime error: reference binding to null pointer of type 'const struct new_allocator'
/usr/include/c++/10/ext/rope:1664:39: runtime error: reference binding to null pointer of type 'const struct allocator'
/usr/include/c++/10/ext/rope:1665:9: runtime error: reference binding to null pointer of type 'const struct allocator_type'
/usr/include/c++/10/ext/rope:725:36: runtime error: reference binding to null pointer of type 'const struct allocator_type'
/usr/include/c++/10/ext/rope:614:64: runtime error: reference binding to null pointer of type 'const struct allocator_type'

The problem is calling r->_M_get_allocator() when r is null.

libstdc++-v3/ChangeLog:

* include/ext/rope (rope::_S_concat_char_iter)
(rope::_S_destr_concat_char_iter): Add allocator parameter.
(rope::push_back, rope::append, rope::insert, operator+):
Pass allocator.
* include/ext/ropeimpl.h (rope::_S_concat_char_iter)
(rope::_S_destr_concat_char_iter): Add allocator parameter
and use it.
(_Rope_char_ref_proxy::operator=(_CharT)): Pass allocator.
libstdc++-v3/include/ext/rope
libstdc++-v3/include/ext/ropeimpl.h