Skip to content

buffer initializer_list before reallocation in array::insert#1174

Open
Ramya-9353 wants to merge 1 commit into
boostorg:developfrom
Ramya-9353:array-insert-initlist-uaf
Open

buffer initializer_list before reallocation in array::insert#1174
Ramya-9353 wants to merge 1 commit into
boostorg:developfrom
Ramya-9353:array-insert-initlist-uaf

Conversation

@Ramya-9353

Copy link
Copy Markdown
Contributor

Repro: a.insert(a.begin(), {a[0], a[1]}) on an array with size() == capacity() reports an ASAN heap-use-after-free; the equivalent self-referential init-list is well defined for std::vector.
Cause: the initializer_list<value_ref> overload builds revert_insert first, which on the growth path frees the old table before write_array dereferences the value_refs that point into it.
Fix: materialise the init-list into a temporary before reserving (as the input-iterator overload already does), then relocate.

@cppalliance-bot

Copy link
Copy Markdown

An automated preview of the documentation is available at https://1174.json.prtest2.cppalliance.org/libs/json/doc/html/index.html

If more commits are pushed to the pull request, the docs will rebuild at the same URL.

2026-07-17 16:53:49 UTC

@cppalliance-bot

Copy link
Copy Markdown

GCOVR code coverage report https://1174.json.prtest2.cppalliance.org/gcovr/index.html
LCOV code coverage report https://1174.json.prtest2.cppalliance.org/genhtml/index.html
Coverage Diff Report https://1174.json.prtest2.cppalliance.org/diff-report/index.html

Build time: 2026-07-17 17:09:29 UTC

@cppalliance-bot

Copy link
Copy Markdown

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants