From 4f808161bc2852bff52cf3dd1bb4baf3003ef181 Mon Sep 17 00:00:00 2001 From: Ben Kimock Date: Sun, 19 Dec 2021 00:18:31 -0500 Subject: Implement split_at_spare_mut directly The previous implementation used slice::as_mut_ptr_range to derive the pointer for the spare capacity slice. This is invalid, because that pointer is derived from the initialized region, so it does not have provenance over the uninitialized region. --- library/alloc/src/vec/mod.rs | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) (limited to 'library/alloc/src/vec') diff --git a/library/alloc/src/vec/mod.rs b/library/alloc/src/vec/mod.rs index d24b4bdffde..a55fce2760f 100644 --- a/library/alloc/src/vec/mod.rs +++ b/library/alloc/src/vec/mod.rs @@ -2141,12 +2141,15 @@ impl Vec { unsafe fn split_at_spare_mut_with_len( &mut self, ) -> (&mut [T], &mut [MaybeUninit], &mut usize) { - let Range { start: ptr, end: spare_ptr } = self.as_mut_ptr_range(); + let ptr = self.as_mut_ptr(); + // SAFETY: + // - `ptr` is guaranteed to be valid for `self.len` elements + let spare_ptr = unsafe { ptr.add(self.len) }; let spare_ptr = spare_ptr.cast::>(); let spare_len = self.buf.capacity() - self.len; // SAFETY: - // - `ptr` is guaranteed to be valid for `len` elements + // - `ptr` is guaranteed to be valid for `self.len` elements // - `spare_ptr` is pointing one element past the buffer, so it doesn't overlap with `initialized` unsafe { let initialized = slice::from_raw_parts_mut(ptr, self.len); -- cgit 1.4.1-3-g733a5