@@ -317,24 +317,28 @@ impl<A: Array> SmallVec<A> {
317
317
pub fn insert_many < I : IntoIterator < Item =A :: Item > > ( & mut self , index : usize , iterable : I ) {
318
318
let iter = iterable. into_iter ( ) ;
319
319
let ( lower_size_bound, _) = iter. size_hint ( ) ;
320
+ assert ! ( lower_size_bound <= std:: isize :: MAX as usize ) ; // Ensure offset is indexable
321
+ assert ! ( index + lower_size_bound >= index) ; // Protect against overflow
320
322
self . reserve ( lower_size_bound) ;
321
323
322
324
unsafe {
323
- let ptr = self . as_mut_ptr ( ) . offset ( index as isize ) ;
324
325
let old_len = self . len ;
326
+ assert ! ( index <= old_len) ;
327
+ let ptr = self . as_mut_ptr ( ) . offset ( index as isize ) ;
325
328
ptr:: copy ( ptr, ptr. offset ( lower_size_bound as isize ) , old_len - index) ;
326
329
for ( off, element) in iter. enumerate ( ) {
327
330
if off < lower_size_bound {
328
331
ptr:: write ( ptr. offset ( off as isize ) , element) ;
329
332
self . len = self . len + 1 ;
330
333
} else {
331
334
// Iterator provided more elements than the hint.
335
+ assert ! ( index + off >= index) ; // Protect against overflow.
332
336
self . insert ( index + off, element) ;
333
337
}
334
338
}
335
339
let num_added = self . len - old_len;
336
340
if num_added < lower_size_bound {
337
- // Iterator provided less elements than the hint
341
+ // Iterator provided fewer elements than the hint
338
342
ptr:: copy ( ptr. offset ( lower_size_bound as isize ) , ptr. offset ( num_added as isize ) , old_len - index) ;
339
343
}
340
344
}
0 commit comments