Skip to content

Commit

Permalink
Update DrainFilter.idx after calling DrainFilter.pred
Browse files Browse the repository at this point in the history
Removes security issue where a panic! from DrainFilter.pred
would leave DrainFilter.idx incremented and risking a double drop.

Fixes: #90
  • Loading branch information
LiquidityC committed Mar 30, 2021
1 parent 045fb28 commit 15567c9
Showing 1 changed file with 5 additions and 2 deletions.
7 changes: 5 additions & 2 deletions src/lib.rs
Original file line number Diff line number Diff line change
Expand Up @@ -3017,12 +3017,15 @@ where
unsafe {
while self.idx != self.old_len {
let i = self.idx;
self.idx += 1;
let v = slice::from_raw_parts_mut(
self.deq.as_mut_ptr(),
self.old_len,
);
if (self.pred)(&mut v[i]) {
let result = (self.pred)(&mut v[i]);
// Update self.idx after calling self.pred
// to prevent inconsistent state
self.idx += 1;
if result {
self.del += 1;
return Some(ptr::read(&v[i]));
} else if self.del > 0 {
Expand Down

0 comments on commit 15567c9

Please # to comment.