"9. Implementing Vec": Dangling pointer overflow?
Nobody has claimed this yet.
- Dominant language
- CSS
- Stars
- 2.3k
- Forks
- 325
- PR merge metrics
- No merged PRs in 30d
Description
I have an impression that in section 9.11. Final Code any fragment containing
usize) + or
usize + can overflow usize (equal to a dangling pointer), which will result in a panic in debug mode.
See also fragment of interest:
RawVec {
ptr: NonNull::dangling(),
Details.
The vector's buffer pointer is initialized to a dangling pointer value (so potentially the dangling buffer pointer can be close to overflowing).
For the zero-sized types the buffer is never allocated (the grow() is never called). So the buffer pointer stays dangling.
During the iterator creation the iterator's pointer
RawValIter::end is initialized to the value ((slice.as_ptr() as usize) + slice.len()), where the fragment as usize) + can overflow the usize (equal to a dangling pointer);
also the iterator's pointer RawValIter::start is initialized to the dangling pointer value (possibly close to overflowing), and during subsequent next() the fragment self.start as usize + 1 can overflow the usize.
Would be nice to see in the text of the book (e.g. in 9.11. Final Code)
- either the confirmation that the overflow can happen (and the reader should handle accordingly),
- or the explanation why the overflow cannot happen.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with section 9.11, “Final Code,” linked in the issue, and inspect the expressions containing usize) +, usize +, and self.start as usize + 1. Determine whether the zero-sized-type path can overflow around NonNull::dangling(), then update the section to explain the behavior and the handling required; done means the text resolves both alternatives raised in the report.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- documentation
- Issue type
- Documentation
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 45/100