-
Notifications
You must be signed in to change notification settings - Fork 154
Closed
Description
This example fails in miri, you can try it on the Playground:
fn main() {
use smallvec::{smallvec, SmallVec};
// This SmallVec can hold up to 4 items on the stack:
let mut v: SmallVec<[i32; 4]> = smallvec![1, 2, 3, 4];
// It will automatically move its contents to the heap if
// contains more than four items:
v.push(5);
// SmallVec points to a slice, so you can use normal slice
// indexing and other methods to access its contents:
v[0] = v[1] + v[2];
v.sort();
v.insert(10, 6);
}
Activity
workingjubilee commentedon Mar 20, 2024
The contract of
pointer::add
, for reference:[-]`SmallVec::insert` is UB[/-][+]`SmallVec::insert` is UB on large arguments[/+]mbrubeck commentedon Mar 20, 2024
This is a regression from #282. It affects versions
>= 1.8.1, <= 1.13.1
.Fix UB on out-of-bounds insert()
Fix UB on out-of-bounds insert()
Fix UB on out-of-bounds insert()
gendx commentedon Jun 27, 2024
FYI, given the UB, I've opened an issue to file a security advisory for this: rustsec/advisory-db#1960.
There are more than 30k crates that transitively depend on
smallvec
's 1.x branch, and given that a fix is available I think folks who regularly usecargo audit
will appreciate that the tooling warns them if they had locked an earlier version.