Fix use-after-free in pbds binary heap
Fixed a use-after-free vulnerability and memory leak in the Policy-Based Data Structures binary heap.
A use-after-free vulnerability and a memory leak in the Policy-Based Data Structures (pbds) binary heap implementation have been fixed. After reallocating storage for the heap, the m_a_entries pointer was left dangling, leading to potential crashes and memory corruption when accessed. The fix ensures that m_a_entries is updated correctly after reallocation, and the leaked memory is also reclaimed. A test case for this specific issue has been added.
In Details
In libstdc++-v3/include/ext/pb_ds/detail/binary_heap_/erase_fn_imps.hpp, the erase_if function in the pbds binary heap was found to have a use-after-free and memory leak. Upon reallocation of the underlying storage, the m_a_entries pointer was not updated, resulting in dangling pointer access and leaked memory. This commit corrects erase_if to update m_a_entries post-reallocation, resolving CVE-2026-102010.
- use-after-free
- A vulnerability where a program attempts to access memory after it has been deallocated, potentially leading to crashes or security exploits.
- memory leak
- A condition where a program fails to release memory that is no longer needed, leading to increased memory consumption over time.
- pbds
- Policy-Based Data Structures, an extension library for the C++ Standard Template Library (STL) providing more advanced data structures.
- binary heap
- A specialized tree-based data structure that satisfies the heap property: in a min-heap, the parent node is always smaller than or equal to its children; in a max-heap, the parent is always greater than or equal to its children. It's commonly used for priority queues.
- reallocation
- The process of resizing and moving memory blocks, typically when a dynamic data structure like an array or heap needs more space.