Skip to content

Internal DevVarStringArray begin/end STL helper should not return char **

Returning char ** makes these iterators dangerous to use with STL algorithms which modify the array, such as std::unique.

For example, the following results in a double free and a leak:

void foo()
{
    DevVarStringArray_var var = new DevVarStringArray;
    DevVarStringArray &array = *var.inout();

    var.length(3);
    var[0] = Tango::string_dup("a");
    var[1] = Tango::string_dup("a");
    var[2] = Tango::string_dup("b");

    char **new_end = std::unique(begin(array), end(array));
    array.length(new_end - begin(array));
}

This is because std::unique copies elements from the end of the array to the beginning, without doing a swap. This means the pointer created by Tango::string_dup("b") appears twice in array after the call to std::unique. One gets deallocated on the call to array.length() at the end, the other gets deallocated when var goes out of scope. The second call to Tango::string_dup("a") is also leaked.

This can probably be avoided with a custom iterator which dereferences to a DevVarStringArray::ElemT.