gdequeue when empty and freed will crash

Original Reporter info from Mantis: 7bit
  • Reporter name: Bernd Kreuss

Description:

A recent change between 3.2.1 and 3.2.3 introduced some new code in gdeque.pp and the problem is in the method ClearData.

The following patch would fix it:

Index: packages/fcl-stl/src/gdeque.pp
===================================================================
--- packages/fcl-stl/src/gdeque.pp      (Revision 49581)
+++ packages/fcl-stl/src/gdeque.pp      (Arbeitskopie)
@@ -213,7 +213,7 @@
 
 procedure TDeque.ClearData;
 var
-  i: SizeUint;
+  i: SizeInt;
 begin
   if IsManagedType(T) then
     for i := Low(FData) to High(FData) do

If FData is empty then Low() will return 0 and High() will return -1 But when trying to cast or compare this to the unsigned index variable then the for loop will begin iterating over the non existing elements and it will immediately SIGSEGV.

I am going to attach the patch as a file to this bug.

Steps to reproduce:

type
  TData = specialize TDeque<String>;

begin
  FData := TData.Create();
  FData.Free;   // this line will crash with SIGSEGV

Mantis conversion info:

  • Mantis ID: 39179
  • Build: Version 3.2.3, revision 49039
  • Version: 3.2.1
  • Fixed in revision: 49584 (#76765c64),49585 (#1a5ad8b8)