From c1cf82f9c8ae92bb338f68d01033fef48a68d045 Mon Sep 17 00:00:00 2001 From: Jiahao Li Date: Fri, 24 Aug 2018 17:35:32 +0000 Subject: [PATCH] variant: fix uninitialized memory access in `variant<>` Currently, in bison's C++ parser template (`lalr.cc`), the `variant<>` struct's `build()` method uses placement-new in the form `new (...) T` to initialize a variant type. However, for POD variant types, this will leave the memory space uninitialized. If we subsequently tries to `::move` into a variant object in such state, the call can trigger clang's undefined behavior sanitizer due to accessing the uninitialized memory. https://lists.gnu.org/archive/html/bison-patches/2018-08/msg00098.html * data/variant.hh (build): Always initialize the stored value. Signed-off-by: Akim Demaille --- data/variant.hh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/data/variant.hh b/data/variant.hh index 1ffc5b26..8d0f06f6 100644 --- a/data/variant.hh +++ b/data/variant.hh @@ -122,7 +122,7 @@ m4_define([b4_variant_define], YYASSERT (!yytypeid_); YYASSERT (sizeof (T) <= S); yytypeid_ = & typeid (T);])[ - return *new (yyas_ ()) T; + return *new (yyas_ ()) T (); } /// Instantiate a \a T in here from \a t.