Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Range bound in Vec::drain may overflow and fail to drain the vector #74909

Closed
Shnatsel opened this issue Jul 29, 2020 · 3 comments
Closed

Range bound in Vec::drain may overflow and fail to drain the vector #74909

Shnatsel opened this issue Jul 29, 2020 · 3 comments
Labels
A-collections Area: `std::collection` C-bug Category: This is a bug. T-libs Relevant to the library team, which will review and decide on the PR/issue.

Comments

@Shnatsel
Copy link
Member

I tried this code:

fn main() {
    let mut v = vec![1,2,3];
    v.drain(..=usize::MAX);
}

According to the documentation this should panic, since usize::MAX is greater than the length of the vector. Instead, no panic happens and no elements are removed from the vector.

Upon investigation it appears that the increment of the upper range bound silently overflows and the range is interpreted as 0..0.

I believe using .saturating_add(1) instead of +1 should make this panic, which is what I'd expect to happen.

Meta

rustc --version --verbose:

Playground stable (1.45)

Found through fuzzing via https://github.com/jakubadamw/rutenspitz

@Shnatsel Shnatsel added the C-bug Category: This is a bug. label Jul 29, 2020
@Shnatsel
Copy link
Member Author

I'd appreciate if someone from the libs team could confirm what the expected behavior is in this case.

@jonas-schievink jonas-schievink added A-collections Area: `std::collection` T-libs Relevant to the library team, which will review and decide on the PR/issue. labels Jul 29, 2020
@tmiasko
Copy link
Contributor

tmiasko commented Jul 29, 2020

#72237 is an existing bug report about overflows in API accepting ranges.

@Shnatsel
Copy link
Member Author

Ah thanks, I'll close this in favor of the existing bug.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
A-collections Area: `std::collection` C-bug Category: This is a bug. T-libs Relevant to the library team, which will review and decide on the PR/issue.
Projects
None yet
Development

No branches or pull requests

3 participants