Skip to content

Fix UB in link_holes: iterator stored in realloc-based Array without construction - #331

Merged
heitzmann merged 1 commit into
heitzmann:mainfrom
psh14:bugfix
Jul 24, 2026
Merged

Fix UB in link_holes: iterator stored in realloc-based Array without construction#331
heitzmann merged 1 commit into
heitzmann:mainfrom
psh14:bugfix

Conversation

@psh14

@psh14 psh14 commented Jul 24, 2026

Copy link
Copy Markdown

Problem

link_holes() in src/clipper_tools.cpp stores a ClipperLib::Path::iterator
inside SortingPath, and instances of SortingPath live in a
gdstk::Array<SortingPath>. gdstk::Array grows via realloc()/plain
assignment and never invokes constructors on its slots, so the iterator ends up
copy-assigned into memory that was never constructed.

Under MSVC with _ITERATOR_DEBUG_LEVEL=2 (the default for Debug builds),
std::vector<T>::iterator is not a bare pointer: it carries _Myproxy /
_Mynextiter bookkeeping used to register itself in a linked list owned by its
vector, and operator= reads those fields on the left-hand side before
overwriting them. Reading them out of uninitialized memory is undefined
behavior, and in practice it reads a garbage pointer and crashes with an access
violation the moment gdstk::boolean(...) needs to produce a polygon with a
hole (e.g. Operation::Not where one operand is fully contained in the other).

Release builds (and any /D_ITERATOR_DEBUG_LEVEL=0 configuration) don't show
this, because there std::vector<T>::iterator degenerates to a thin pointer
wrapper with a trivial operator=, so the same UB happens to be harmless —
which is presumably why this has gone unnoticed.

…e a realloc-based gdstk::Array without construction, which crashes under MSVC /D_ITERATOR_DEBUG_LEVEL=2 (Debug builds) because operator= reads the iterator's debug-linkage fields from uninitialized memory. Store an index instead.
@heitzmann

Copy link
Copy Markdown
Owner

Thanks!

@heitzmann
heitzmann merged commit c5d1e43 into heitzmann:main Jul 24, 2026
6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants