Skip to content

Fix panic safety when reserving during splice - #593

Open
charliermarsh wants to merge 1 commit into
servo:v2from
astral-sh:charlie/codex-fix-splice-reserve-panic
Open

Fix panic safety when reserving during splice#593
charliermarsh wants to merge 1 commit into
servo:v2from
astral-sh:charlie/codex-fix-splice-reserve-panic

Conversation

@charliermarsh

Copy link
Copy Markdown

This PR fixes a double free when splice panics while reserving space:

use smallvec::SmallVec;

let mut v: SmallVec<Box<u8>, 4> = SmallVec::from_buf([Box::new(7)]);
drop(v.splice(0..0, std::iter::repeat_with(|| Box::new(1))));

While reserving, we temporarily increase the vector's length to include the elements we're keeping. If reserve panics, we skip resetting the length, so cleanup adds those elements a second time.

Instead, we can use try_reserve which allows us to reset the length before panicking.

@alejandro-vaz

alejandro-vaz commented Sep 8, 2026

Copy link
Copy Markdown
Collaborator

I'm withholding both of your PRs because of #590 and #592, I've seen them

thanks for contributing

@charliermarsh

Copy link
Copy Markdown
Author

No worries, thanks for the quick reply

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants