Memory Unsafety on 16bit Platforms for Range.collect() #48006
Labels
C-bug
Category: This is a bug.
I-unsound
Issue: A soundness hole (worst kind of bug), see: https://en.wikipedia.org/wiki/Soundness
T-libs-api
Relevant to the library API team, which will review and decide on the PR/issue.
TrustedLen
is implemented for Range for every integer primitve T. TrustedLen requires that the upper bound of.size_hint
is None if the iterator produces more thanusize::MAX
elements.<Range as Iterator>.size_hint
usessteps_between
to produce its result. The implementation ofsteps_between
subtracts the lower from the upper value and casts it to usize. This is implemented undconditionally for u32. On 16bit platforms, the result of the subtraction of two u32 values may not fit insideusize
, producing an invalidsize_hint
.This means, that e.g. collecting into a Vec using its
SpecExtend::spec_extend
specialization for TrustedLen allows writing beyond its reserved buffer. One such example input would be(0..(usize::MAX as u32 + 1)).collect::<Vec<_>>()
.Reference: #47944 (comment)
/cc @bluss
The text was updated successfully, but these errors were encountered: