PR #2169: Fix use-after-free in raw_hash_set move-assign with unequal allocators Imported from GitHub PR https://github.com/abseil/abseil-cpp/pull/2169 ## Issue Fixes #2168 — `raw_hash_set` move assignment into a non-empty table with unequal, non-propagating allocators probes and inserts into the freed backing array (heap-use-after-free, reported by Fengxiaoxx with an ASan trace). ## Root cause `move_assign(that, std::false_type)` calls `destructor_impl()` on the destination, which deallocates the backing array but leaves `common()` describing the old capacity and control bytes. `move_elements_allocs_unequal()` then calls `reserve()`/`insert()` against that stale state: the insert probe reads freed control bytes (`GroupSse2Impl`/`GroupAArch64Impl` construction → ASan `heap-use-after-free`), writes slots into freed memory, hits the `full table!` assert in debug builds, and hangs in `NDEBUG` builds. With a non-freeing resource (e.g. `monotonic_buffer_resource`) the destination silently keeps its old elements (`dst.size()` = 32 instead of 16). ## Fix Reset `common()` to the default state immediately after `destructor_impl()`, so the destination is a clean empty table before re-insertion: ```cpp destructor_impl(); // destructor_impl() leaves common() pointing at the freed backing array // (or at the stale small-table state), so reset it to the default state // before re-inserting elements. common() = CommonFields::CreateDefault<SooEnabled()>(); ``` This mirrors the identical reset that `assign_impl()` and `move_elements_allocs_unequal()` already perform on the source's `common()` after teardown. ## Test New `NoPropagateOnMove.MoveAssignmentWithDifferentAllocToNonEmptyTable` in `raw_hash_set_allocator_test.cc`: move-assigns a 1-element table into a 16-element table under a different allocator id. On the unfixed code the test reports `u.size()==16` and aborts on the `full table!` assertion (`raw_hash_set.h:3498`); the existing `MoveAssignmentWithDifferentAlloc` test only covered an empty destination. ## Verification - Reporter's `flat_hash_set<int, ..., std::pmr::polymorphic_allocator<int>>` reproducer (two unequal `memory_resource`s, 16 elements each side): - Unpatched: ASan `heap-use-after-free` READ in `GroupAArch64Impl` (`hashtable_control_bytes.h:369`) via `find_or_prepare_insert_large` → `insert` → `move_elements_allocs_unequal`; freed region = destination backing array deallocated by `destructor_impl()`. - Patched: prints `dst.size()=16`, no sanitizer findings. - `absl_raw_hash_set_allocator_test`: 29/29 pass (including the new test; it fails and asserts on the unfixed build). - `absl_raw_hash_set_test`: 297/297 pass. Merge e47fa80392937a8273d0cc5ced7f5f0260d99653 into 2c256e73951c4209da19359b4347f5035f64add3 Merging this change closes #2169 PiperOrigin-RevId: 986724238 Change-Id: I6103cd3a95d237bc16d771216f05711ea2c32cc8
The repository contains the Abseil C++ library code. Abseil is an open-source collection of C++ code (compliant to C++17) designed to augment the C++ standard library.
Abseil is an open-source collection of C++ library code designed to augment the C++ standard library. The Abseil library code is collected from Google's own C++ code base, has been extensively tested and used in production, and is the same code we depend on in our daily coding lives.
In some cases, Abseil provides pieces missing from the C++ standard; in others, Abseil provides alternatives to the standard for special needs we've found through usage in the Google code base. We denote those cases clearly within the library code we provide you.
Abseil is not meant to be a competitor to the standard library; we've just found that many of these utilities serve a purpose within our code base, and we now want to provide those resources to the C++ community as a whole.
If you want to just get started, make sure you at least run through the Abseil Quickstart. The Quickstart contains information about setting up your development environment, downloading the Abseil code, running tests, and getting a simple binary working.
Bazel and CMake are the official build systems for Abseil. See the quickstart for more information on building Abseil using the Bazel build system. If you require CMake support, please check the CMake build instructions and CMake Quickstart.
Abseil follows Google's Foundational C++ Support Policy. See this table for a list of currently supported versions compilers, platforms, and build tools.
Abseil contains the following C++ library components:
base base library contains initialization code and other code which all other Abseil code depends on. Code within base may not depend on any other code (other than the C++ standard library).algorithm algorithm library contains additions to the C++ <algorithm> library and container-based versions of such algorithms.cleanup cleanup library contains the control-flow-construct-like type absl::Cleanup which is used for executing a callback on scope exit.container container library contains additional STL-style containers, including Abseil's unordered “Swiss table” containers.crc The crc library contains code for computing error-detecting cyclic redundancy checks on data.debugging debugging library contains code useful for enabling leak checks, and stacktrace and symbolization utilities.flags flags library contains code for handling command line flags for libraries and binaries built with Abseil.hash hash library contains the hashing framework and default hash functor implementations for hashable types in Abseil.log log library contains LOG and CHECK macros and facilities for writing logged messages out to disk, stderr, or user-extensible destinations.memory memory library contains memory management facilities that augment C++'s <memory> library.meta meta library contains type checks similar to those available in the C++ <type_traits> library.numeric numeric library contains 128-bit integer types as well as implementations of C++20's bitwise math functions.profiling profiling library contains utility code for profiling C++ entities. It is currently a private dependency of other Abseil libraries.random random library contains functions for generating pseudorandom values.status status library contains abstractions for error handling, specifically absl::Status and absl::StatusOr<T>.strings strings library contains a variety of strings routines and utilities.synchronization synchronization library contains concurrency primitives (Abseil's absl::Mutex class, an alternative to std::mutex) and a variety of synchronization abstractions.time time library contains abstractions for computing with absolute points in time, durations of time, and formatting and parsing time within time zones.types types library contains non-container utility types.utility utility library contains utility and helper code.Abseil recommends users “live-at-head” (update to the latest commit from the master branch as often as possible). However, we realize this philosophy doesn't work for every project, so we also provide Long Term Support Releases to which we backport fixes for severe bugs. See our release management document for more details.
The Abseil C++ library is licensed under the terms of the Apache license. See LICENSE for more information.
For more information about Abseil: