Skip to content

Vec::into_flattened() may overflow isize::MAX with ZST #148661

@leftmostcat

Description

@leftmostcat

For Vec<T> where T is a ZST, Vec::into_flattened() uses usize::checked_mul() as the length and usize::MAX as the capacity of the new Vec, ultimately passing the capacity to new_cap() without further checking and violating its safety invariants.

Metadata

Metadata

Assignees

No one assigned

    Labels

    C-bugCategory: This is a bug.needs-triageThis issue may need triage. Remove it if it has been sufficiently triaged.

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions