Spooky C++
nablag.com
nablag.com
https://quuxplusone.github.io/blog/2018/03/27/string-view-is...
These are cases where the core language helps the programmer out, and basically makes a whole class of bugs — well, not impossible, but difficult to run into if you're not actually trying. There are other cases, e.g. `string_view sv = stuff();` as used in TFA, where the core language offers no help at all, but there's an easy solution available. ("Don't do that, then." Treat `string_view` as a "parameter-only type" and you'll never encounter that kind of problem.)
And then there's C++20 coroutine "parameters," where the core language pretty actively tries to trip you up. https://quuxplusone.github.io/blog/2019/07/10/ways-to-get-da...
Would you return `input.c_str()`? You might think twice about that, but it's the same thing. My favorite fix is to take a `std::string_view` as the parameter.
string_view remove_leading_spaces(string_view input) {
auto new_start = find_if(input.begin(), input.end(), [](char ch) { return ch != ' '; });
return string_view(new_start, input.end());
}
std::string_view username = Sanitize("foobarbazboo");
^- temporary std::string created here
std::string_view Sanitize(const std::string& input) { ... }
^ ^- reference to that temporary string
+- returns a view to a temporary string
std::string_view username = // possibly data freed and dangling stringI've got a nice `==31604==ERROR: AddressSanitizer: stack-use-after-scope on address`
The real fix is don't pass in a temporary to the sanitize function.
12 != 8
I don't get it...
> As you can guess, this is an example of undefined behavior causing unintuitive results.
No I couldn't... and what undefined behavior where? They don't explain anything.
And the bug comes from the temporary string object created when he passes in the string to Sanitize.
Sanitize("foobarbaz") -> creates temporary string -> string_view from temporary string -> returns string_view of temporary string
temporary string destructed
operations on returned string_view -> oops, use after free.q
And the while loop shouldn't even run at all since front() never equals ' '.
That is effectively what is happening internally. A string_view is morally a pointer/length pair; that pointer has to be initialized somehow.
> and even if it's just internally referencing the (static) string
It's not. The function call constructs a temporary std::string from the string literal, but once that is done the contents of the temporary are entirely independent from the string literal.
struct string_view { const char * ref; }
Possibly useful elaboration: https://quuxplusone.github.io/blog/2022/12/15/sophist/
In C++, where "reference" and "pointer" both have technical (jargon) meanings, you might still get away with calling string_view a "handle" (to a contiguous bunch of characters). See also https://quuxplusone.github.io/blog/2023/02/04/jargon-treadmi...
As for the rest of the bug, my guess is:
1. Construct a temporary std::string for "foobarbazbug". The length of this string is 12 so it's stored on the stack due to the short/small string optimization.
2. Call Sanitize, passing a pointer to the temporary
3. Store the return value of Sanitize. Note that this return value is basically a pointer to the entire contents of the temporary, which due to SSO means the return value is actually a pointer to a specific bit of stack memory
4. Destroy the temporary.
5. Construct a std::string for the admin_id, reusing the stack slot for the temporary. This data also ends up on the stack due to SSO.
6. username == admin_id. username points to the stack memory formerly occupied by the argument passed to Sanitize(), which is now occupied by admin_id. As a result this comparison is effectively admin_id == admin_id, which is obviously true.
I suspect (but can't check for now) that due to the dependence on SSO lengths up to 16 should work in general, up to 22 (or 23? Can't remember) should work for libc++, and beyond that is not very likely to work at all.