1
Fork 0

catch overflow in slice size computation

This commit is contained in:
Ralf Jung 2022-03-27 20:02:11 -04:00
parent 53c540a666
commit a417911c16
4 changed files with 69 additions and 43 deletions

View file

@ -694,7 +694,8 @@ impl<'mir, 'tcx: 'mir, M: Machine<'mir, 'tcx>> InterpCx<'mir, 'tcx, M> {
let elem = layout.field(self, 0);
// Make sure the slice is not too big.
let size = elem.size * len;
let size = elem.size.bytes().saturating_mul(len); // we rely on `max_size_of_val` being smaller than `u64::MAX`.
let size = Size::from_bytes(size);
if size > self.max_size_of_val() {
throw_ub!(InvalidMeta("slice is bigger than largest supported object"));
}