When filling a vector<bool> with stuff, initialize the last word of the storage that you're touching. Otherwise, when we lay down the bits with operator&=, we get UB from reading uninitialized memory. Fixes Bug 39354. Thanks to David Wagner for the bug report.
llvm-svn: 345067
Cr-Mirrored-From: sso://chromium.googlesource.com/_direct/external/github.com/llvm/llvm-project
Cr-Mirrored-Commit: 55fb053f577ece32711e4d785d8ccca4f70cdf09
diff --git a/include/vector b/include/vector
index de7de09..8ac7576 100644
--- a/include/vector
+++ b/include/vector
@@ -2606,6 +2606,8 @@
{
size_type __old_size = this->__size_;
this->__size_ += __n;
+ if (__old_size == 0 || (__old_size / __bits_per_word) != (this->__size_ / __bits_per_word))
+ this->__begin_[this->__size_ / __bits_per_word] = __storage_type(0);
_VSTD::fill_n(__make_iter(__old_size), __n, __x);
}
@@ -2620,6 +2622,8 @@
{
size_type __old_size = this->__size_;
this->__size_ += _VSTD::distance(__first, __last);
+ if (__old_size == 0 || (__old_size / __bits_per_word) != (this->__size_ / __bits_per_word))
+ this->__begin_[this->__size_ / __bits_per_word] = __storage_type(0);
_VSTD::copy(__first, __last, __make_iter(__old_size));
}