Unsafe vector overflow

[Veedrac]

This gives undefined behaviour due to overflow:

fn main() {
    let one_iter = Some(0).into_iter();
    let big_iter = std::iter::repeat(0).take(usize::max_value());

    one_iter.chain(big_iter).collect::<Vec<_>>();
}

The problem is the overflow on the addition here:

rust/src/libcollections/vec.rs

Lines 1485 to 1489 in a643092

	let mut vector = Vec::with_capacity(1 + lower);
	unsafe {
	ptr::write(vector.get_unchecked_mut(0), element);
	vector.set_len(1);
	}

[alexcrichton]

Could you clarify what the undefined behavior you're seeing is? This is just a standard panic for me:

thread '<main>' panicked at 'capacity overflow', /home/rustbuild/src/rust-buildbot/slave/stable-dist-rustc-linux/build/src/libcore/option.rs:330

[Veedrac]

Forgot to mention, this only happens on nightly (in release builds).

http://is.gd/OdmHAG

application terminated abnormally with signal 4 (Illegal instruction)

[sfackler]

The SIGILL is the result of the failure to malloc the entire address space.

I believe the only undefined behavior badness the from_iter logic can run into is if 1 + lower overflows to 0, in which case the get_unchecked_mut call will end up as an out of bounds write.

[sfackler]

cc @gankro

[Veedrac]

I believe the only undefined behavior badness the from_iter logic can run into is if 1 + lower overflows to 0, in which case the get_unchecked_mut call will end up as an out of bounds write.

That's what's happening.

I was expecting oom to give a different error, though. To evidence my claim, gdb says it crashes on a null pointer write:

r::ptr::write<i32> (dst=0x0, src=-1) at ../src/libcore/ptr.rs:247
247 ../src/libcore/ptr.rs: No such file or directory.

whereas decreasing the memory a bit to get an OOM errors inside of with_capacity.

[Veedrac]

There's another unchecked addition here:

https://github.com/rust-lang/rust/blob/af9693cd9ee222b733d19499de97e767d649cf74/src/libcollections/vec.rs#L1573

[sfackler]

They're both fixed in #26563

[Veedrac]

Indeed, sorry.