Skip to content

Commit 37718f9

Browse files
committed
fix OOB pointer formed in Vec::index
Move the length check to before using `index` with `ptr::add` to prevent an out of bounds pointer from being formed. Fixes #122760
1 parent a77c20c commit 37718f9

File tree

1 file changed

+3
-4
lines changed

1 file changed

+3
-4
lines changed

library/alloc/src/vec/mod.rs

+3-4
Original file line numberDiff line numberDiff line change
@@ -1541,6 +1541,9 @@ impl<T, A: Allocator> Vec<T, A> {
15411541
}
15421542

15431543
let len = self.len();
1544+
if index > len {
1545+
assert_failed(index, len);
1546+
}
15441547

15451548
// space for the new element
15461549
if len == self.buf.capacity() {
@@ -1556,10 +1559,6 @@ impl<T, A: Allocator> Vec<T, A> {
15561559
// Shift everything over to make space. (Duplicating the
15571560
// `index`th element into two consecutive places.)
15581561
ptr::copy(p, p.add(1), len - index);
1559-
} else if index == len {
1560-
// No elements need shifting.
1561-
} else {
1562-
assert_failed(index, len);
15631562
}
15641563
// Write it in, overwriting the first copy of the `index`th
15651564
// element.

0 commit comments

Comments
 (0)