diff --git a/src/libstd/vec.rs b/src/libstd/vec.rs index a69ffca026b..191c2a4a0b2 100644 --- a/src/libstd/vec.rs +++ b/src/libstd/vec.rs @@ -1172,7 +1172,11 @@ impl OwnedVector for ~[T] { vec_reserve_shared_actual(td, ptr as **raw::VecRepr, n as libc::size_t); } else { let alloc = n * sys::nonzero_size_of::(); - *ptr = realloc_raw(*ptr as *mut c_void, alloc + size_of::()) + let size = alloc + size_of::(); + if alloc / sys::nonzero_size_of::() != n || size < alloc { + fail!("vector size is too large: %u", n); + } + *ptr = realloc_raw(*ptr as *mut c_void, size) as *mut raw::VecRepr; (**ptr).unboxed.alloc = alloc; } @@ -3327,4 +3331,13 @@ mod tests { values.mut_slice(2,4).set_memory(0xFF); assert_eq!(values, [0xAB, 0xAB, 0xFF, 0xFF, 0xAB]); } + + #[test] + #[should_fail] + fn test_overflow_does_not_cause_segfault() { + let mut v = ~[]; + v.reserve(-1); + v.push(1); + v.push(2); + } }