Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-8301373

Potential use after free in GrowableArray

XMLWordPrintable

      Consider the following code:

          Foo f;
          GrowableArray<Foo> arr(1, 1, f); // contains 1 copy of 'f'
          GrowableArray arr2(arr); // copy constructed

          arr.push(f); // add another copy of f

          Foo* foo_adr = arr2.adr_at(0); // reference to first element
          // or: Foo& foo_ref = arr2.at(0);

          foo_adr->do_something(); // BOOM!

      Note that `arr` and `arr2` share a pointer to the underlying `_data` array.

      When the call to 'push' happens, the capacity of the array is not big enough for the new element. This means that a new array is allocated, the elements copied to the new array, and the destructor is called for each element in the old array.

      But, the data pointer of arr2 is not updated. This means that `foo_adr` will point at a destroyed object.

      This can be prevented by making either:
      - Making GrowableArray NONCOPYABLE
      - Copying the _data array when the GrowableArray object is copied, so that `arr` and `arr2` in the example will have a distinct set of elements.

        There are no Sub-Tasks for this issue.

            Unassigned Unassigned
            jvernee Jorn Vernee
            Votes:
            0 Vote for this issue
            Watchers:
            8 Start watching this issue

              Created:
              Updated: