rust-lang/rust

`Vec::into_flattened()` may overflow `isize::MAX` with ZST

Opened this issue · 1 comments

For Vec<T> where T is a ZST, Vec::into_flattened() uses usize::checked_mul() as the length and usize::MAX as the capacity of the new Vec, ultimately passing the capacity to new_cap() without further checking and violating its safety invariants.

The invariant is that allocations are less than isize::MAX bytes, so for ZST elements a capacity of usize::MAX is fine. In fact, even Vec::new() with ZST element has maximal capacity.