string::replace (size_type pos, size_type n1, value_type* s, size_type n2) implementation doesn't verify n2 argument
--------------------------------------------------------------------------------------------------------------------

         Key: STDCXX-175
         URL: http://issues.apache.org/jira/browse/STDCXX-175
     Project: C++ Standard Library
        Type: Bug

  Components: 21. Strings  
    Versions: 4.1.3    
 Environment: all
    Reporter: Anton Pevtsov
    Priority: Minor


The following test fails with segmentation fault:

#include <iostream>
#include <string>
#include <stdexcept>

static char long_string [4096] = {'a'};

int main (void)
{
    try 
    {
        std::string s (long_string, 4095);
        s.replace (0, 1, "a", s.max_size () + 1);
        std::cout << "Expect length error, got nothing" << '\n';
    }
    catch (std::length_error& e)
    {
        std::cout << "Got expected length error" << '\n';
    }
    return 0;
}

See the discussion for additional details:
http://mail-archives.apache.org/mod_mbox/incubator-stdcxx-dev/200604.mbox/%3c444EC747.1090200@roguewave.com%3e


-- 
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
   http://issues.apache.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see:
   http://www.atlassian.com/software/jira