@@ -317,24 +317,28 @@ impl<A: Array> SmallVec<A> {
317317 pub fn insert_many < I : IntoIterator < Item =A :: Item > > ( & mut self , index : usize , iterable : I ) {
318318 let iter = iterable. into_iter ( ) ;
319319 let ( lower_size_bound, _) = iter. size_hint ( ) ;
320+ assert ! ( lower_size_bound <= std:: isize :: MAX as usize ) ; // Ensure offset is indexable
321+ assert ! ( index + lower_size_bound >= index) ; // Protect against overflow
320322 self . reserve ( lower_size_bound) ;
321323
322324 unsafe {
323- let ptr = self . as_mut_ptr ( ) . offset ( index as isize ) ;
324325 let old_len = self . len ;
326+ assert ! ( index <= old_len) ;
327+ let ptr = self . as_mut_ptr ( ) . offset ( index as isize ) ;
325328 ptr:: copy ( ptr, ptr. offset ( lower_size_bound as isize ) , old_len - index) ;
326329 for ( off, element) in iter. enumerate ( ) {
327330 if off < lower_size_bound {
328331 ptr:: write ( ptr. offset ( off as isize ) , element) ;
329332 self . len = self . len + 1 ;
330333 } else {
331334 // Iterator provided more elements than the hint.
335+ assert ! ( index + off >= index) ; // Protect against overflow.
332336 self . insert ( index + off, element) ;
333337 }
334338 }
335339 let num_added = self . len - old_len;
336340 if num_added < lower_size_bound {
337- // Iterator provided less elements than the hint
341+ // Iterator provided fewer elements than the hint
338342 ptr:: copy ( ptr. offset ( lower_size_bound as isize ) , ptr. offset ( num_added as isize ) , old_len - index) ;
339343 }
340344 }
0 commit comments