Skip to content

Commit a46b2b8

Browse files
committed
vec: with_capacity: check for overflow
Fixes #10271
1 parent 46100c0 commit a46b2b8

File tree

1 file changed

+5
-1
lines changed

1 file changed

+5
-1
lines changed

src/libstd/vec.rs

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -186,7 +186,11 @@ pub fn with_capacity<T>(capacity: uint) -> ~[T] {
186186
vec
187187
} else {
188188
let alloc = capacity * mem::nonzero_size_of::<T>();
189-
let ptr = malloc_raw(alloc + mem::size_of::<Vec<()>>()) as *mut Vec<()>;
189+
let size = alloc + mem::size_of::<Vec<()>>();
190+
if alloc / mem::nonzero_size_of::<T>() != capacity || size < alloc {
191+
fail!("vector size is too large: {}", capacity);
192+
}
193+
let ptr = malloc_raw(size) as *mut Vec<()>;
190194
(*ptr).alloc = alloc;
191195
(*ptr).fill = 0;
192196
cast::transmute(ptr)

0 commit comments

Comments
 (0)