CERT.EXPR.MOVED_FROM.RANGE

Do not access elements in the moved-from range produced by an erase-remove algorithm

The CERT.EXPR.MOVED_FROM.RANGE checker implements CERT C++ rule EXP63-CPP. It detects uses of container elements in the range returned by algorithms such as std::remove, std::remove_if, and std::unique. These algorithms do not remove elements from the container; instead, they move retained elements to the front and leave the remaining elements in a valid but unspecified state. Accessing elements in this trailing range can result in the use of unspecified values.

This checker complements CERT.EXPR.MOVED_FROM.USE, which detects uses of objects after explicit move operations, whereas CERT.EXPR.MOVED_FROM.RANGE focuses on accesses to the unspecified-value range produced by algorithms such as std::remove() and std::unique().

Vulnerability and risk

After std::remove(first, last, val) returns new_last, the elements in [new_last, last) are in a moved-from state. Iterating past new_last exposes the caller to any value the implementation happened to leave behind, typically a duplicate of an earlier element, but the standard does not guarantee this. The container's size and end iterator are unchanged, so range-based for loops and index-bounded size() loops silently read the unspecified tail. In pipelines that chain remove/unique with printing, hashing, or serialization, corrupt values propagate downstream without any warning at the source site.

Vulnerable code example 1: return value ignored, full iteration

1
2
3
4
5
6
7
8
9
10
#include <algorithm>
#include <iostream>
#include <vector>

void case1_remove_full_iteration(std::vector<int> &c) {
    std::remove(c.begin(), c.end(), 42);   // source: return value ignored
    for (auto v : c) {                     // CERT.EXPR.MOVED_FROM.RANGE
        std::cout << v << std::endl;       // reads into [new_last, last)
    }
}

std::remove shifts non-matching elements to the front and returns the new logical end, but the container size is unchanged. Iterating the whole range with for (auto v : c) reads every element up to c.end(), including the moved-from tail.

Vulnerable code example 2: c.end()-bounded index loop

1
2
3
4
5
6
7
8
9
10
11
#include <algorithm>
#include <iostream>
#include <vector>

void case4_walk_to_end(std::vector<int> &c) {
    auto e = std::remove(c.begin(), c.end(), 0);
    (void)e;                                                   // boundary discarded
    for (auto it = c.begin(); it != c.end(); ++it) {           // CERT.EXPR.MOVED_FROM.RANGE
        std::cout << *it << std::endl;                         // deref into [e, end())
    }
}

Capturing the returned iterator into e is not enough. If the loop still iterates up to c.end() and e is never used, the loop dereferences the moved-from tail.

1
2
3
4
5
6
7
8
9
10
11
12
#include <algorithm>
#include <iostream>
#include <vector>

static void applyRemove(std::vector<int> &c, int val) {
    std::remove(c.begin(), c.end(), val);   // moved-from state escapes via &c
}

void fn_a1_source_in_callee(std::vector<int> &c) {
    applyRemove(c, 7);
    std::cout << c.front() << '\n';         // CERT.EXPR.MOVED_FROM.RANGE
}

1
2
3
4
5
6
7
8
9
10
#include <algorithm>
#include <iostream>
#include <vector>

void case1_respect_boundary(std::vector<int> &c) {
    auto e = std::remove(c.begin(), c.end(), 42);
    for (auto i = c.begin(); i != e; ++i) {   // OK: stops at the valid end
        std::cout << *i << std::endl;
    }
}

#include <algorithm>
#include <iostream>
#include <vector>

void case2_erase_remove(std::vector<int> &c) {
    c.erase(std::remove(c.begin(), c.end(), 42), c.end());   // OK: tail erased
    for (auto v : c) {
        std::cout << v << std::endl;
    }
}