1 result · Feed
-
Unscored —
Panic-safety unsoundness in `BitVecCore::clear` (double-free / use-after-free)
`BitVecCore::clear` drops every occupied element with `drop_in_place` and only afterwards clears the occupancy bits and resets `len`. If an element's `Drop` panics, those metadata updates are skipped, so the slot of the already-dropped element stays marked as…