buffer overflow in boost::container::flat_map on FreeBSD

[boostorg]

buffer overflow in boost::container::flat_map on FreeBSD

[arthaud]

It looks like this will be fixed in libc++: https://bugs.llvm.org/show_bug.cgi?id=40230

[igaztanaga]

Thanks for the report. This nasty pair class was used to portably support all compilers (including C++03 compilers, where std::pair had no move semantics or placement constructors.) One workaround is to embed an internal std::pair inside the dtl::pair class to guarantee excatly the same memory layout.

The second step would be to use the native std::pair on compilers withou full C++11 support.

I'll try the first workaround in the following days and inform about progress in this bug.

[igaztanaga]

The first workaround is not possible because pair exposes "first" and "second" as public members. We can try to reproduce the padding in libcpp with the following patch. Could please test it, as I haven't been able to set up the virtual machine yet?
boost_container_libcpp.txt

[arthaud]

Thanks for the patch. Unfortunately I'm getting the following error:

$ c++ test.cpp -I/tmp/boost/include
In file included from test.cpp:3:
In file included from /tmp/boost/include/container/include/boost/container/flat_map.hpp:29:
In file included from /tmp/boost/include/container/include/boost/container/detail/flat_tree.hpp:29:
/tmp/boost/include/container/include/boost/container/detail/pair.hpp:211:67: error: too many arguments provided to function-like macro invocation
   : pair_padding<T1, T2, offsetof(std::pair<T1 BOOST_MOVE_I T2>, first) >
                                                                  ^
/usr/include/sys/cdefs.h:476:9: note: macro '__offsetof' defined here
#define __offsetof(type, field)  __builtin_offsetof(type, field)
        ^
In file included from test.cpp:3:
In file included from /tmp/boost/include/container/include/boost/container/flat_map.hpp:29:
In file included from /tmp/boost/include/container/include/boost/container/detail/flat_tree.hpp:29:
/tmp/boost/include/container/include/boost/container/detail/pair.hpp:211:27: error: use of undeclared identifier '__offsetof'
   : pair_padding<T1, T2, offsetof(std::pair<T1 BOOST_MOVE_I T2>, first) >
                          ^
/usr/include/stddef.h:75:31: note: expanded from macro 'offsetof'
#define offsetof(type, field)   __offsetof(type, field)
                                ^
In file included from test.cpp:3:
In file included from /tmp/boost/include/container/include/boost/container/flat_map.hpp:29:
In file included from /tmp/boost/include/container/include/boost/container/detail/flat_tree.hpp:29:
/tmp/boost/include/container/include/boost/container/detail/pair.hpp:213:1: error: expected class name
{
^
3 errors generated.

Regarding the patch, I would like to suggest to check for _LIBCPP_DEPRECATED_ABI_DISABLE_PAIR_TRIVIAL_COPY_CTOR instead of _LIBCPP_VERSION. This will avoid possible regressions on most systems and save compile time.

[arthaud]

It compiles with -std=c++11 but the bug is still there, I'm trying to investigate this.

EDIT: It was an error on my side. It still doesn't compile with -std=c++11

EDIT 2: It looks like a common macro problem, where the comma in std::pair< T1, T2 > is treated as an argument separator for the macro offset_of. This is probably why you tried to use BOOST_MOVE_I but it didn't work.

[igaztanaga]

I've reproduced the problem in Linux using clang -stdlib=libc++ and defining "_LIBCPP_DEPRECATED_ABI_DISABLE_PAIR_TRIVIAL_COPY_CTOR".

New patch attached, the patch
boost_container_pair_libcpp_patch.txt
compiles in C++03 and C++2a modes.

[arthaud]

I confirm that the patch fixes the issue, thank you.

[igaztanaga]

Many thanks for the report and help solving the issue. Fixed in commit:

2b5197a

[igaztanaga]

There was a typo in the committed patch, corrected with commit:

8078925