Skip to content

Commit 1c254ff

Browse files
committed
Assert to check for overflow
1 parent 15c41c8 commit 1c254ff

File tree

1 file changed

+6
-2
lines changed

1 file changed

+6
-2
lines changed

lib.rs

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -317,24 +317,28 @@ impl<A: Array> SmallVec<A> {
317317
pub fn insert_many<I: IntoIterator<Item=A::Item>>(&mut self, index: usize, iterable: I) {
318318
let iter = iterable.into_iter();
319319
let (lower_size_bound, _) = iter.size_hint();
320+
assert!(lower_size_bound <= std::isize::MAX as usize); // Ensure offset is indexable
321+
assert!(index + lower_size_bound >= index); // Protect against overflow
320322
self.reserve(lower_size_bound);
321323

322324
unsafe {
323-
let ptr = self.as_mut_ptr().offset(index as isize);
324325
let old_len = self.len;
326+
assert!(index <= old_len);
327+
let ptr = self.as_mut_ptr().offset(index as isize);
325328
ptr::copy(ptr, ptr.offset(lower_size_bound as isize), old_len - index);
326329
for (off, element) in iter.enumerate() {
327330
if off < lower_size_bound {
328331
ptr::write(ptr.offset(off as isize), element);
329332
self.len = self.len + 1;
330333
} else {
331334
// Iterator provided more elements than the hint.
335+
assert!(index + off >= index); // Protect against overflow.
332336
self.insert(index + off, element);
333337
}
334338
}
335339
let num_added = self.len - old_len;
336340
if num_added < lower_size_bound {
337-
// Iterator provided less elements than the hint
341+
// Iterator provided fewer elements than the hint
338342
ptr::copy(ptr.offset(lower_size_bound as isize), ptr.offset(num_added as isize), old_len - index);
339343
}
340344
}

0 commit comments

Comments
 (0)