c++ - Iterator invalid read of size 4 -

why might valgrind indicate invalid read of size 4 in following line?

for (map<uint16_t, spacket *>::iterator = m_packetmap.begin() ; != m_packetmap.end(); ++it)  {     if (it->first < acknumber)     {         if (it->second->data) delete [] it->second->data;         if (it->second) delete it->second;         m_packetmap.erase(it);     } } 

i verify m_packetmap.size() > 0 before loop , have temporarily added debug before loop verify m_packetmap contents looks expected. valgrind error message , radiomanager.cpp:1042 line above:

==5535== invalid read of size 4 ==5535==    @ 0x421ebe5: std::_rb_tree_increment(std::_rb_tree_node_base*) (in /usr/lib/i386-linux-gnu/libstdc++.so.6.0.16) ==5535==    0x80ad20d: radiomanager::decodeacknowledgementnumber(unsigned char*, unsigned int) (radiomanager.cpp:1042) 

this how spacket , m_packetmap defined

typedef struct spacket {     uint8_t * data;     size_t size;     timeval tval; } spacket; map<uint16_t, spacket *> m_packetmap; 

is there issue iterator, possible issue in _rb_tree_increment, or else entirely?

erasing container elements for loop has done care...

you must do:

map<uint16_t, spacket *>::iterator = m_packetmap.begin() while ( != m_packetmap.end() )  {     if (it->first < acknumber)     {         if (it->second->data) delete [] it->second->data;         if (it->second) delete it->second;         // updated erase, no need increment         = m_packetmap.erase(it);     }     else     {         // move next item         ++it;     } } 

that's way loop removing elements of container must written (works same set, vector...).

for maps, code above works c++11. if use earlier version, according this post (not tested), should do:

for ( map<uint16_t, spacket *>::iterator = m_packetmap.begin(); != m_packetmap.end();  )  {     if (it->first < acknumber)     {         if (it->second->data) delete [] it->second->data;         if (it->second) delete it->second;         // updated erase, no need increment         m_packetmap.erase(it++);     }     else     {         // move next item         ++it;     } } 

because erasing item , incrementing (what end doing for loop) make loose elements , possible pass on m_packetmap.end() (and have loop cover items out of container's limits) if erase last element container.