_Hash_bytes crashes when len is 2^31 or greater.  The length is converted to int at hash_bytes.cc line 142, resulting in a negative number if the length doesn't fit in an int variable.  Then end < buf resulting in an infinite loop that eventually runs into inaccessible memory.
#include <unordered_set>
#include <string>
#include <iostream>
int main() {
    size_t big = size_t(1) << 31;
    std::cout << "line " << __LINE__ << std::endl;
    // this succeeds
    std::hash<std::string>{}(std::string(big - 1, 'a'));
    std::cout << "line " << __LINE__ << std::endl;
    // segfault at libstdc++-v3/libsupc++/hash_bytes.cc:147
    std::hash<std::string>{}(std::string(big, 'a'));
    std::cout << "line " << __LINE__ << std::endl;
I think we should just use size_t for the len_aligned variable:
--- a/libstdc++-v3/libsupc++/hash_bytes.cc
+++ b/libstdc++-v3/libsupc++/hash_bytes.cc
@@ -139,7 +139,7 @@ _GLIBCXX_BEGIN_NAMESPACE_VERSION
     // Remove the bytes not divisible by the sizeof(size_t).  This
     // allows the main loop to process the data as 64-bit integers.
-    const int len_aligned = len & ~0x7;
+    const size_t len_aligned = len & ~0x7;
     const char* const end = buf + len_aligned;
     size_t hash = seed ^ (len * mul);
     for (const char* p = buf; p != end; p += 8)
URL: https://gcc.gnu.org/viewcvs?rev=269584&root=gcc&view=rev
PR libstdc++/89629 fix _Hash_bytes for lengths > INT_MAX
	PR libstdc++/89629
	* libsupc++/hash_bytes.cc [__SIZEOF_SIZE_T__ == 8] (_Hash_bytes):
	Use correct type for len_aligned.
	* testsuite/20_util/hash/89629.cc: New test.
Added:
    trunk/libstdc++-v3/testsuite/20_util/hash/89629.cc
Modified:
    trunk/libstdc++-v3/ChangeLog
    trunk/libstdc++-v3/libsupc++/hash_bytes.cc

URL: https://gcc.gnu.org/viewcvs?rev=270959&root=gcc&view=rev PR libstdc++/89629 fix _Hash_bytes for lengths > INT_MAX Backport from mainline 2019-03-11 Jonathan Wakely < [email protected] > PR libstdc++/89629 * libsupc++/hash_bytes.cc [__SIZEOF_SIZE_T__ == 8] (_Hash_bytes): Use correct type for len_aligned. * testsuite/20_util/hash/89629.cc: New test. Added: branches/gcc-8-branch/libstdc++-v3/testsuite/20_util/hash/89629.cc Modified: branches/gcc-8-branch/libstdc++-v3/ChangeLog branches/gcc-8-branch/libstdc++-v3/libsupc++/hash_bytes.cc URL: https://gcc.gnu.org/viewcvs?rev=271009&root=gcc&view=rev PR libstdc++/89629 fix _Hash_bytes for lengths > INT_MAX Backport from mainline 2019-03-11 Jonathan Wakely < [email protected] > PR libstdc++/89629 * libsupc++/hash_bytes.cc [__SIZEOF_SIZE_T__ == 8] (_Hash_bytes): Use correct type for len_aligned. * testsuite/20_util/hash/89629.cc: New test. Added: branches/gcc-7-branch/libstdc++-v3/testsuite/20_util/hash/89629.cc Modified: branches/gcc-7-branch/libstdc++-v3/ChangeLog branches/gcc-7-branch/libstdc++-v3/libsupc++/hash_bytes.cc