1 result · Feed
-
Unscored —
Double free / use-after-free in `Chunk` and `InlineArray` removal methods when an element's `Drop` panics
`Chunk::{clear, drop_left, drop_right}` and `InlineArray::{clear, truncate}` drop the removed elements before updating the metadata that records which slots hold live values — the `left`/`right` index pair for `Chunk`, the length field for `InlineArray`. If a…