Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

"9. Implementing Vec": Dangling pointer overflow? #433

Open
kuzminrobin opened this issue Dec 4, 2023 · 0 comments
Open

"9. Implementing Vec": Dangling pointer overflow? #433

kuzminrobin opened this issue Dec 4, 2023 · 0 comments

Comments

@kuzminrobin
Copy link

I have an impression that in section 9.11. Final Code any fragment containing
usize) + or
usize + can overflow usize (equal to a dangling pointer), which will result in a panic in debug mode.

See also fragment of interest:

RawVec {
    ptr: NonNull::dangling(),

Details.
The vector's buffer pointer is initialized to a dangling pointer value (so potentially the dangling buffer pointer can be close to overflowing).

For the zero-sized types the buffer is never allocated (the grow() is never called). So the buffer pointer stays dangling.

During the iterator creation the iterator's pointer
RawValIter::end is initialized to the value ((slice.as_ptr() as usize) + slice.len()), where the fragment as usize) + can overflow the usize (equal to a dangling pointer);
also the iterator's pointer RawValIter::start is initialized to the dangling pointer value (possibly close to overflowing), and during subsequent next() the fragment self.start as usize + 1 can overflow the usize.


Would be nice to see in the text of the book (e.g. in 9.11. Final Code)

  • either the confirmation that the overflow can happen (and the reader should handle accordingly),
  • or the explanation why the overflow cannot happen.
@kuzminrobin kuzminrobin changed the title 9. Implementing Vec: Dangling pointer overflow? "9. Implementing Vec": Dangling pointer overflow? Dec 4, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant