diff --git a/src/lib.rs b/src/lib.rs index 0241aef..3c54268 100644 --- a/src/lib.rs +++ b/src/lib.rs @@ -1041,7 +1041,7 @@ impl SmallVec { let mut cur = ptr.add(num_added); if num_added >= lower_size_bound { // Iterator provided more elements than the hint. Move trailing items again. - self.reserve(1); + self.reserve(guard.len + 1); let start = self.as_mut_ptr(); ptr = start.add(index); cur = ptr.add(num_added); diff --git a/src/tests.rs b/src/tests.rs index 0452ae8..90dff5f 100644 --- a/src/tests.rs +++ b/src/tests.rs @@ -905,3 +905,18 @@ fn empty_macro() { fn zero_size_items() { SmallVec::<[(); 0]>::new().push(()); } + +#[test] +fn test_insert_many_overflow() { + let mut v: SmallVec<[u8; 0]> = SmallVec::new(); + + // Spill on heap + v.push(123); + + // Prepare an iterator with small lower bound + let iter = (0u8..=255).filter(|n| n % 2 == 0); + assert_eq!(iter.size_hint().0, 0); + + // Triggering the bug + v.insert_many(0, iter); +}