Merge pull request #3472 from qingshi163/fix-slice-overflow

youknowone · web-flow · commit e740de697b1d · 2021-11-28T20:04:29.000+09:00
fix #3468 SaturatedSliceIter overflow
diff --git a/vm/src/builtins/slice.rs b/vm/src/builtins/slice.rs
@@ -368,13 +368,15 @@ impl SaturatedSliceIter {
 
 impl Iterator for SaturatedSliceIter {
     type Item = usize;
+
     fn next(&mut self) -> Option<Self::Item> {
         if self.len == 0 {
             return None;
         }
         self.len -= 1;
         let ret = self.index as usize;
-        self.index += self.step;
+        // SAFETY: if index is overflowed, len should be zero
+        self.index = self.index.wrapping_add(self.step);
         Some(ret)
     }
 }

Original file line number	Diff line number	Diff line change
`@@ -368,13 +368,15 @@ impl SaturatedSliceIter {`
`368`	`368`
`369`	`369`	`impl Iterator for SaturatedSliceIter {`
`370`	`370`	`type Item = usize;`
	`371`	`+`
`371`	`372`	`fn next(&mut self) -> Option<Self::Item> {`
`372`	`373`	`if self.len == 0 {`
`373`	`374`	`return None;`
`374`	`375`	`}`
`375`	`376`	`self.len -= 1;`
`376`	`377`	`let ret = self.index as usize;`
`377`		`- self.index += self.step;`
	`378`	`+ // SAFETY: if index is overflowed, len should be zero`
	`379`	`+ self.index = self.index.wrapping_add(self.step);`
`378`	`380`	`Some(ret)`
`379`	`381`	`}`
`380`	`382`	`}`