boostorg / container

STL-like containers from Boost
http://www.boost.org/libs/container/
Boost Software License 1.0
100 stars 116 forks source link

Get rid of integer overflow in copy_move_algo.hpp (-fsanitize=integer). #109

Closed Breakthrough closed 5 years ago

Breakthrough commented 5 years ago

When running a program with -fsanitize=integer, I get runtime errors on line 514 of copy_move_algo.hpp due to the way the while loop is written:

[...] boost/container/detail/copy_move_algo.hpp:514:15: runtime error: unsigned integer overflow: 0 - 1 cannot be represented in type 'typename boost::container::allocator_traits<new_allocator<pair<unsigned int, __normal_iterator<const unsigned int *, vector<unsigned int, allocator > > > > >::size_type' (aka 'unsigned long')

When the loop terminates, n-- will cause unsigned integer overflow in n. Although the value of n is discarded otherwise, this behavior is likely unwanted and unintentional, thus I'm submitting this PR.

igaztanaga commented 5 years ago

Thanks for the patch.