diff options
author | Jonathan Wakely <jwakely@redhat.com> | 2022-06-14 14:37:25 +0100 |
---|---|---|
committer | Jonathan Wakely <jwakely@redhat.com> | 2022-08-03 12:30:01 +0100 |
commit | 2ef2de76dae5cac14e0de77ca7205e43be03ab22 (patch) | |
tree | c432a77988cf6b58804efeb437bfa8d5869e9650 /libstdc++-v3 | |
parent | 8a57deb926cd660c2eae7ed621d61a301ae0d523 (diff) |
libstdc++: Check for size overflow in constexpr allocation [PR105957]
libstdc++-v3/ChangeLog:
PR libstdc++/105957
* include/bits/allocator.h (allocator::allocate): Check for
overflow in constexpr allocation.
* testsuite/20_util/allocator/105975.cc: New test.
(cherry picked from commit 0a9af7b4ef1b8aa85cc8820acf54d41d1569fc10)
Diffstat (limited to 'libstdc++-v3')
-rw-r--r-- | libstdc++-v3/include/bits/allocator.h | 7 | ||||
-rw-r--r-- | libstdc++-v3/testsuite/20_util/allocator/105975.cc | 18 |
2 files changed, 24 insertions, 1 deletions
diff --git a/libstdc++-v3/include/bits/allocator.h b/libstdc++-v3/include/bits/allocator.h index f7770165273..a4b80d924d6 100644 --- a/libstdc++-v3/include/bits/allocator.h +++ b/libstdc++-v3/include/bits/allocator.h @@ -179,7 +179,12 @@ _GLIBCXX_BEGIN_NAMESPACE_VERSION allocate(size_t __n) { if (std::__is_constant_evaluated()) - return static_cast<_Tp*>(::operator new(__n * sizeof(_Tp))); + { + if (__builtin_mul_overflow(__n, sizeof(_Tp), &__n)) + std::__throw_bad_array_new_length(); + return static_cast<_Tp*>(::operator new(__n)); + } + return __allocator_base<_Tp>::allocate(__n, 0); } diff --git a/libstdc++-v3/testsuite/20_util/allocator/105975.cc b/libstdc++-v3/testsuite/20_util/allocator/105975.cc new file mode 100644 index 00000000000..4342aeade04 --- /dev/null +++ b/libstdc++-v3/testsuite/20_util/allocator/105975.cc @@ -0,0 +1,18 @@ +// { dg-options "-std=gnu++20" } +// { dg-do compile { target c++20 } } + +// PR libstdc++/105957 + +#include <memory> + +consteval bool test_pr105957() +{ + std::allocator<long long> a; + auto n = std::size_t(-1) / (sizeof(long long) - 1); + auto p = a.allocate(n); // { dg-error "constexpr" } + a.deallocate(p, n); + return true; +} +static_assert( test_pr105957() ); + +// { dg-error "throw_bad_array_new_length" "" { target *-*-* } 0 } |