在 'Tree::deleteValueObject' 中出现类型混淆
Tree t;
t.setPrimitive<v_uint64>(0x4142434445464748ULL); // an ordinary integer
t.setVector(0xFFFFFFFFFFFFFFFFULL); // tag -> VECTOR, then length_error
// ~Tree -> deleteValueObject() -> delete (std::vector)0x4142434445464748
Build and run:
clang++-22 -fsanitize=address,undefined,vptr -fsanitize-recover=all
-fno-omit-frame-pointer -frtti -g -O1 -std=c++17 -I/src
poc_Tree_deleteValueObject.cpp liboatpp.a -lpthread -o poc_Tree_deleteValueObject
ASAN_OPTIONS=halt_on_error=0:new_delete_type_mismatch=1 ./poc_Tree_deleteValueObject
ASAN output :
[] before: type=12 (UINT_64=12)
[*] caught: cannot create std::vector larger than max_size()
[!] after : type=16 (VECTOR=16) <-- tag moved, payload did not
[!] isVector()=1 -> every getVector() now returns (vector)0x4142434445464748
==...==ERROR: AddressSanitizer: SEGV
[...]
#1 in oatpp::data::mapping::Tree::deleteValueObject() src/oatpp/data/mapping/Tree.cpp:231:7
#2 in oatpp::data::mapping::Tree::~Tree()
内容来源: oatpp/oatpp