1 result · Feed
-
Unscored —
Double free / use-after-free in `ReadChunk::commit` when an element's `Drop` panics
`ReadChunk::commit` and `ReadChunk::commit_all` drop the committed elements before advancing the consumer head. If an element's `Drop` panics during the drop loop, `head` is never advanced, so the ring buffer still treats those slots as holding live elements.…