[Bug libstdc++/64646] New: New overloads of std::is_permutation dereference past-the-end iterator

[redi at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64646

            Bug ID: 64646
           Summary: New overloads of std::is_permutation dereference
                    past-the-end iterator
           Product: gcc
           Version: 5.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: libstdc++
          Assignee: unassigned at gcc dot gnu.org
          Reporter: redi at gcc dot gnu.org

#include <algorithm>
#include <forward_list>
#include <assert.h>

int main()
{
  std::forward_list<int> l1{0}, l2;
  assert( !std::is_permutation(l1.begin(), l1.end(), l2.begin(), l2.end()) );
}

Aborts when compiled with -std=c++14 -D_GLIBCXX_DEBUG

There's a missing range check:

--- a/libstdc++-v3/include/bits/stl_algo.h
+++ b/libstdc++-v3/include/bits/stl_algo.h
@@ -3604,7 +3607,7 @@ _GLIBCXX_BEGIN_NAMESPACE_VERSION

       // Efficiently compare identical prefixes:  O(N) if sequences
       // have the same elements in the same order.
-      for (; __first1 != __last1; ++__first1, ++__first2)
+      for (; __first1 != __last1 && __first2 != __last2; ++__first1,
++__first2)
        if (!__pred(__first1, __first2))
          break;