Jacob Pratt f4043f8c09 Rollup merge of #155708 - Manishearth:borrow-fix, r=Mark-Simulacrum ...

Fix heap overflow in slice::join caused by misbehaving Borrow

This code allocates a buffer using lengths calculated by calling `.borrow()` on some slices, and then copies them over after again calling `.borrow()`. There is no safety-reliable guarantee that these will return the same slices.

While this code calls `.borrow()` three times, only one of them is problematic: the others already use checked indexing.

I made the test a normal library test, but let me know if it should go elsewhere.

Bug discovered by Rust Foundation Security using AI. I'm just helping with the patch as a member of wg-security-response. We do not believe this bug needs embargo, it is a soundness fix for hard-to-trigger unsoundness.

2026-04-26 21:56:41 -04:00

..

src

Rollup merge of #155708 - Manishearth:borrow-fix, r=Mark-Simulacrum

2026-04-26 21:56:41 -04:00

Cargo.toml

compiler-builtins: Clean up features

2026-03-30 18:45:13 -04:00