forked/hyper
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(http): Fix heap corruption in http::buffer::grow_zerofill

Browse Source 
Fixes #1010
This commit is contained in:
Kornelijus Survila
2017-01-16 16:06:03 -06:00
committed by Sean McArthur
parent e4232dd0d8
commit 6e4739f918
2 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/http/buf.rs
View File

@@ -141,7 +141,7 @@ impl MemBuf {
unsafe fn grow_zerofill(buf: &mut Vec<u8>, additional: usize) { unsafe fn grow_zerofill(buf: &mut Vec<u8>, additional: usize) {
let len = buf.len(); let len = buf.len();
buf.set_len(len + additional); buf.set_len(len + additional);
::std::ptr::write_bytes(buf.as_mut_ptr().offset(len as isize), 0, buf.len()); ::std::ptr::write_bytes(buf.as_mut_ptr().offset(len as isize), 0, additional);
} }
impl fmt::Debug for MemBuf { impl fmt::Debug for MemBuf {

2
src/http/buffer.rs
View File

@@ -103,5 +103,5 @@ impl Buffer {
unsafe fn grow_zerofill(buf: &mut Vec<u8>, additional: usize) { unsafe fn grow_zerofill(buf: &mut Vec<u8>, additional: usize) {
let len = buf.len(); let len = buf.len();
buf.set_len(len + additional); buf.set_len(len + additional);
ptr::write_bytes(buf.as_mut_ptr().offset(len as isize), 0, buf.len()); ptr::write_bytes(buf.as_mut_ptr().offset(len as isize), 0, additional);
} }