[STDCXX-1060] std::basic_string::append(char*, pos) SIGSEGV for pos == std::string::npos

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 4.2.1, 4.2.x, 4.3.x, 5.0.0
• Fix Version/s: 4.2.2, 4.2.x, 4.3.x, 5.0.0
• Component/s: 21. Strings
• Labels: conformance segmenation_fault standards

Environment

Solaris 10 and 11
Red Hat Linux, OpenSuSE Linux
Sun C++ Compiler 12.1, 12.2, 12.3

Defect is independent of platform/compiler

• Patch Info: Patch Available
• Regression: Regression, Unit Test Broken
• Severity: Incorrect Behavior
• Assignee: Farid Zaripov
• Reporter: Stefan Teleman
• Created: 06/Feb/12 03:13
• Updated: 02/May/13 02:29
• Resolved: 19/Feb/12 18:52

Description

std::basic_string::append(char*, pos) SIGSEGV for pos == std::string::npos:

test.cc

#include <iostream>
#include <string>
#include <stdexcept>

int main()
{
    const char* c = "hello";
    std::string s(5, '*');
    std::string t;
    int ret;

    try
    {
        t = s.append(c, std::string::npos);
    }
    catch (std::length_error& e)
    {
        ret = 0;
    }
    catch ( ... )
    {
        std::cerr << "wrong exception was thrown!" << std::endl;
        ret = 1;
    }

    std::cerr << "t: " << t.c_str() << std::endl;
    std::cerr << "s: " << s.c_str() << std::endl;

    return ret;
}

1. Output from GCC 4.5.0:

[steleman@darthvader][/src/steleman/programming/stdcxx-ss122/bugfixes-sunw/6889785][02/05/2012 21:56:30][2023]>> ./test-gcc 
t: 
s: *****
[steleman@darthvader][/src/steleman/programming/stdcxx-ss122/bugfixes-sunw/6889785][02/05/2012 22:04:45][2024]>> echo $status
0

2. Output from Sun C++ 12.2 with stlport:

[steleman@darthvader][/src/steleman/programming/stdcxx-ss122/bugfixes-sunw/6889785][02/05/2012 22:04:47][2025]>> ./test-ss122-stlport 
t: 
s: *****
[steleman@darthvader][/src/steleman/programming/stdcxx-ss122/bugfixes-sunw/6889785][02/05/2012 22:04:53][2026]>> echo $status
0

3. Output from Sun C++ 12.2 with our patched stdcxx:

[steleman@darthvader][/src/steleman/programming/stdcxx-ss122/bugfixes-sunw/6889785][02/05/2012 22:04:55][2027]>> ./test-ss122-stdcxx 
t: 
s: *****
[steleman@darthvader][/src/steleman/programming/stdcxx-ss122/bugfixes-sunw/6889785][02/05/2012 22:05:00][2028]>> echo $status
0

4. Output from Pathscale 4.0.12.1 (which did not patch stdcxx):

[steleman@darthvader][/src/steleman/programming/stdcxx-ss122/bugfixes-sunw/6889785][02/05/2012 22:05:02][2029]>> ./test-pathscale 
Segmentation fault (core dumped)
[steleman@darthvader][/src/steleman/programming/stdcxx-ss122/bugfixes-sunw/6889785][02/05/2012 22:05:08][2030]>> echo $status
139

Defect is in file include/string, line 874.

Patch for stdcxx 4.2.1 to follow shortly.

Issue Links

• depends upon: STDCXX-1063 std::string::replace (size_type, size_type, size_type, char_type) doesn't check third argument
• depends upon: STDCXX-175 std::string::replace (size_type, size_type, const_pointer, size_type) doesn't check last argument