1 result · Feed
-
Unscored —
Double free / use-after-free in `Consumer::skip` and `Consumer::clear` when an element's `Drop` panics
`Consumer::skip()` and `Consumer::clear()` are not panic-safe. They drop the consumed elements in place and only afterwards call `advance_read_index()` to move the ring buffer's read index past them. If an element's `Drop` panics mid-loop, `advance_read_index…