Repository navigation
Prevent memory unsafety when array offset values are >isize::MAX #34
Description
From #28:
All of these casts to isize when offsetting are unsafe, since they could become negative numbers and cause us to write outside of the bounds of the array. We should either use to_isize.unwrap() and panic if that occurs, or use a conversion strategy that yields a value that will gives us worse performance but correct behaviour.
At a quick readthrough, it looks like push, pop, truncate, remove, insert all suffer from the same issue if len > isize::MAX.
It looks like one might be able to manipulate that situation in a call to insert() when len == isize::MAX (then the len would get set to size::MAX + 1).
Activity
emilio commentedon Oct 4, 2016
I doubt it's worth to fix that if this makes
SmallVecslower. Any array ofisize::MAXelements is literally half of the address space in the computer.mbrubeck commentedon Jun 21, 2017
It's currently impossible to create a SmallVec with a length greater than
isize::MAX, becauseVec::with_capacitywill panic if the capacity overflowsisize. I'm not sure if this is guaranteed to remain true in future versions of Rust, though. (It's not documented in the publiclibstddocs, though it is documented in the unstableliballocdocumentation.)mbrubeck commentedon Jun 21, 2017
(We could remove all doubt by adding our own assertions that the capacity never exceeds
isize::MAX.)alejandro-vaz commentedon Aug 25, 2026
already implemented on v2
if this was ever an issue in v1, it certainly hasn't manifested itself in the last 10 years