I am not 100% certain about this one, but while debugging one of our tools (with address sanitizer enabled) I discovered an std::string with a non-null-terminated payload. This is problematic as c_str() will just return a pointer to the internal buffer:
|
_NODISCARD _CONSTEXPR20 _Ret_z_ const _Elem* c_str() const noexcept {
|
|
return _Mypair._Myval2._Myptr();
|
|
}
|
|
_CONSTEXPR20 const value_type* _Myptr() const noexcept {
|
|
const value_type* _Result = _Bx._Buf;
|
|
if (_Large_string_engaged()) {
|
|
_Result = _Unfancy(_Bx._Ptr);
|
|
}
|
|
|
|
return _Result;
|
|
}
|
Tracking down the construction, the problematic code is here:
|
#ifdef _INSERT_STRING_ANNOTATION
|
|
_Traits::move(_My_data._Bx._Buf, _Arg, _Count);
|
|
#else // ^^^ _INSERT_STRING_ANNOTATION ^^^ // vvv !_INSERT_STRING_ANNOTATION vvv
|
|
_Traits::move(_My_data._Bx._Buf, _Arg, _BUF_SIZE);
|
|
#endif // !_INSERT_STRING_ANNOTATION
|
Instead of moving the whole buffer (including the terminator) from the source, this moves only _Count characters, which does not include the terminator. Subsequent code does/did not add the required terminator.
I am not 100% certain about this one, but while debugging one of our tools (with address sanitizer enabled) I discovered an
std::stringwith a non-null-terminated payload. This is problematic asc_str()will just return a pointer to the internal buffer:STL/stl/inc/xstring
Lines 4254 to 4256 in c873cf0
STL/stl/inc/xstring
Lines 2290 to 2297 in c873cf0
Tracking down the construction, the problematic code is here:
STL/stl/inc/xstring
Lines 2754 to 2758 in c873cf0
Instead of moving the whole buffer (including the terminator) from the source, this moves only
_Countcharacters, which does not include the terminator. Subsequent code does/did not add the required terminator.