{"action":"opened","issue":{"url":"https://api.github.com/repos/carllerche/bytes/issues/46","repository_url":"https://api.github.com/repos/carllerche/bytes","labels_url":"https://api.github.com/repos/carllerche/bytes/issues/46/labels{/name}","comments_url":"https://api.github.com/repos/carllerche/bytes/issues/46/comments","events_url":"https://api.github.com/repos/carllerche/bytes/issues/46/events","html_url":"https://github.com/carllerche/bytes/issues/46","id":173406834,"number":46,"title":"Buffer overflow","user":{"login":"stbuehler","id":528446,"avatar_url":"https://avatars.githubusercontent.com/u/528446?v=3","gravatar_id":"","url":"https://api.github.com/users/stbuehler","html_url":"https://github.com/stbuehler","followers_url":"https://api.github.com/users/stbuehler/followers","following_url":"https://api.github.com/users/stbuehler/following{/other_user}","gists_url":"https://api.github.com/users/stbuehler/gists{/gist_id}","starred_url":"https://api.github.com/users/stbuehler/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stbuehler/subscriptions","organizations_url":"https://api.github.com/users/stbuehler/orgs","repos_url":"https://api.github.com/users/stbuehler/repos","events_url":"https://api.github.com/users/stbuehler/events{/privacy}","received_events_url":"https://api.github.com/users/stbuehler/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2016-08-26T09:15:02Z","updated_at":"2016-08-26T09:15:02Z","closed_at":null,"body":"Buffer overflow in `impl<'a> Sink for &'a mut Vec<u8>`\r\n\r\n```rust\r\n\tlet mut sink: Vec<u8> = Vec::new();\r\n\tsink.reserve(16);\r\n\tprintln!(\"Capacity: {}\", sink.capacity());\r\n\tlet mut source = Cursor::new(b\"0123456789abcdef0123456789abcdef\");\r\n\tsink.copy_from(&mut source);\r\n\tprintln!(\"Length: {}, Capacity: {}\", sink.len(), sink.capacity());\r\n```\r\n\r\nprints:\r\n```\r\nCapacity: 16\r\nLength: 32, Capacity: 16\r\n```\r\n\r\nThe error is in the call to reserve: you don't reserve \"more capacity\", instead you are only guaranteed there is enough space to insert the requested number of elements, i.e. you need to base it on length instead of capacity.\r\n\r\nIs there a really good reason why you need `unsafe` here?\r\n\r\n```rust\r\n\tself.resize(buf.remaining(), 0);\r\n\tbuf.read_slice(&mut self[..]);\r\n```\r\n\r\nIs not zeroing the buffer really that performance critical to risk buffer overflows like this one?"}}
{"actor":{"display_login":"stbuehler"}}