Side effect handling in specialized zip implementation causes buffer overflow
Closed this issue · 2 comments
Qwaz commented
rust/library/core/src/iter/adapters/zip.rs
Lines 200 to 208 in 0148b97
rust/library/core/src/iter/adapters/zip.rs
Lines 214 to 218 in 0148b97
self.index
can be set to a value greater than self.len
in this branch. This causes integer overflow in size_hint()
and lead to a buffer overflow.
Playground Link that demonstrates segfault with safe Rust code.
Qwaz commented
For the context, this causes a buffer overflow by violating the safety requirement of TrustedRandomAccess
trait.
rust/library/core/src/iter/adapters/zip.rs
Lines 384 to 406 in 0148b97
hameerabbasi commented
Assigning P-critical
as part of the WG-prioritization discussion on Zulip.