Use-after-free in map.cc

[jcelerier]

Context

Thankfully recent versions of GCC detect it:

[ 33%] Building CXX object src/CMakeFiles/bctoolbox.dir/containers/map.cc.o
/home/jcelerier/.cache/yay/bctoolbox/src/bctoolbox-5.1.71/src/containers/map.cc: In function 'bctbx_iterator_t* bctbx_iterator_ullong_get_next_and_delete(bctbx_iterator_t*)':
/home/jcelerier/.cache/yay/bctoolbox/src/bctoolbox-5.1.71/src/containers/map.cc:234:16: error: pointer 'it' used after 'void operator delete(void*)' [-Werror=use-after-free]
  234 |         return next;
      |                ^~~~
In function 'void bctbx_iterator_delete_type(bctbx_iterator_t*) [with T = std::multimap<long long unsigned int, void*>]',
    inlined from 'void bctbx_iterator_ullong_delete(bctbx_iterator_t*)' at /home/jcelerier/.cache/yay/bctoolbox/src/bctoolbox-5.1.71/src/containers/map.cc:256:43,
    inlined from 'bctbx_iterator_t* bctbx_iterator_ullong_get_next_and_delete(bctbx_iterator_t*)' at /home/jcelerier/.cache/yay/bctoolbox/src/bctoolbox-5.1.71/src/containers/map.cc:233:30:
/home/jcelerier/.cache/yay/bctoolbox/src/bctoolbox-5.1.71/src/containers/map.cc:253:9: note: call to 'void operator delete(void*)' here
  253 |         delete ((typename T::iterator*)it);
      |         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/home/jcelerier/.cache/yay/bctoolbox/src/bctoolbox-5.1.71/src/containers/map.cc: In function 'bctbx_iterator_t* bctbx_iterator_cchar_get_next_and_delete(bctbx_iterator_t*)':
/home/jcelerier/.cache/yay/bctoolbox/src/bctoolbox-5.1.71/src/containers/map.cc:239:16: error: pointer 'it' used after 'void operator delete(void*)' [-Werror=use-after-free]
  239 |         return next;
      |                ^~~~
In function 'void bctbx_iterator_delete_type(bctbx_iterator_t*) [with T = std::multimap<std::__cxx11::basic_string<char>, void*>]',
    inlined from 'void bctbx_iterator_cchar_delete(bctbx_iterator_t*)' at /home/jcelerier/.cache/yay/bctoolbox/src/bctoolbox-5.1.71/src/containers/map.cc:259:42,
    inlined from 'bctbx_iterator_t* bctbx_iterator_cchar_get_next_and_delete(bctbx_iterator_t*)' at /home/jcelerier/.cache/yay/bctoolbox/src/bctoolbox-5.1.71/src/containers/map.cc:238:29:
/home/jcelerier/.cache/yay/bctoolbox/src/bctoolbox-5.1.71/src/containers/map.cc:253:9: note: call to 'void operator delete(void*)' here
  253 |         delete ((typename T::iterator*)it);
      |         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
cc1plus: all warnings being treated as errors
make[2]: *** [src/CMakeFiles/bctoolbox.dir/build.make:216: src/CMakeFiles/bctoolbox.dir/containers/map.cc.o] Error 1
make[1]: *** [CMakeFiles/Makefile2:136: src/CMakeFiles/bctoolbox.dir/all] Error 2
make: *** [Makefile:136: all] Error 2
==> ERROR: A failure occurred in build().
    Aborting...

General information

• OS: Arch Linux
• GCC 12.2

Expected behaviour

Library does not contain memory safety issues

To Reproduce

1. On arch linux, try to compile the AUR package bctoolbox-git

Additional context

No response

SDK logs URL

No response