https://gcc.gnu.org/bugzilla/show_bug.cgi?id=127656
Bug ID: 127656
Summary: Fix CVE-2026-102010 Denial of Service via
use-after-free in binary heap erase_if
Product: gcc
Version: 17.0
Status: UNCONFIRMED
Severity: normal
Priority: P3
Component: libstdc++
Assignee: unassigned at gcc dot gnu.org
Reporter: jiannmao at qq dot com
Target Milestone: ---
For CVE-2026-102010 https://bugzilla.redhat.com/show_bug.cgi?id=2478395, the AI
provided a patch which may be incorrect and cannot be applied to the master
branch.
Here is a viable patch that fixes the issue. In `erase_if`, the assignment to
`m_a_entries` is missing after `deallocate`. Adding it back is sufficient,
consistent with the implementation in `clear` and `resize_for_erase_if_needed`.
```
--- a/libstdc++-v3/include/ext/pb_ds/detail/binary_heap_/erase_fn_imps.hpp
+++ b/libstdc++-v3/include/ext/pb_ds/detail/binary_heap_/erase_fn_imps.hpp
@@ -122,6 +122,7 @@ erase_if(Pred pred)
std::copy(m_a_entries, m_a_entries + left, new_entries);
s_entry_allocator.deallocate(m_a_entries, m_actual_size);
m_actual_size = new_size;
+ m_a_entries = new_entries;
resize_policy::notify_arbitrary(m_actual_size);
}
__catch(...)
```
Do we have an estimated timeline for fixing this vulnerability?
