Cursor position silently wraps around during write to Vec<u8>

[ghost]

use std::io::{Cursor, Write};

fn main() {
    let v = vec![0];
    let mut c = Cursor::new(v);
    c.set_position(std::usize::MAX as u64 + 1);
    c.write(&[1]).unwrap();
    println!("{:?}", c.into_inner());
}

On 32-bit platform it currently prints: "[1]". It should fail or panic instead.

[abonander]

This line here seems to be the culprit: https://github.com/rust-lang/rust/blob/master/src/libstd/io/cursor.rs#L251

[abonander]

Also, I don't know why zero-filling is necessary, as they'll just be immediately overwritten. If it's an issue of panic safety, then there's probably a better way to do it.

[ghost]

The cursor implementation for vector is similar to file operations. If cursor
position is set past the current size of vector, then on subsequent write,
first the hole between vector length and position is filled with zeros.
Ensuring that the position is guaranteed to be within vector (or one past the
end).

Second, the data is actually written starting from cursor position, extending
vector even further. This is potentially unfortunate allocation-wise, but no
data is overwritten (when resize actually took place).

In general the Cursor interface seems potentially error prone for in-memory
buffers due to mismatch between u64 and usize. It works fine for files, but
that's it.

[Mark-Simulacrum]

This is no longer an issue, since we check for the potential overflow and return an error instead:

rust/src/libstd/io/cursor.rs

Line 258 in 10d7cb4

let pos: usize = self.position().try_into().map_err(|_| {

. Closing.