diff --git a/src/libcore/slice/mod.rs b/src/libcore/slice/mod.rs index 62adaea168a3f..a76b30260369d 100644 --- a/src/libcore/slice/mod.rs +++ b/src/libcore/slice/mod.rs @@ -34,6 +34,7 @@ use cmp::Ordering::{self, Less, Equal, Greater}; use cmp; use fmt; use intrinsics::assume; +use isize; use iter::*; use ops::{FnMut, Try, self}; use option::Option; @@ -3851,6 +3852,9 @@ unsafe impl<'a, T> TrustedRandomAccess for ExactChunksMut<'a, T> { /// them from other data. You can obtain a pointer that is usable as `data` /// for zero-length slices using [`NonNull::dangling()`]. /// +/// The total size of the slice must be no larger than `isize::MAX` **bytes** +/// in memory. See the safety documentation of [`pointer::offset`]. +/// /// # Caveat /// /// The lifetime for the returned slice is inferred from its usage. To @@ -3872,10 +3876,13 @@ unsafe impl<'a, T> TrustedRandomAccess for ExactChunksMut<'a, T> { /// ``` /// /// [`NonNull::dangling()`]: ../../std/ptr/struct.NonNull.html#method.dangling +/// [`pointer::offset`]: ../../std/primitive.pointer.html#method.offset #[inline] #[stable(feature = "rust1", since = "1.0.0")] pub unsafe fn from_raw_parts<'a, T>(data: *const T, len: usize) -> &'a [T] { debug_assert!(data as usize % mem::align_of::() == 0, "attempt to create unaligned slice"); + debug_assert!(mem::size_of::().saturating_mul(len) <= isize::MAX as usize, + "attempt to create slice covering half the address space"); Repr { raw: FatPtr { data, len } }.rust } @@ -3885,15 +3892,19 @@ pub unsafe fn from_raw_parts<'a, T>(data: *const T, len: usize) -> &'a [T] { /// This function is unsafe for the same reasons as [`from_raw_parts`], as well /// as not being able to provide a non-aliasing guarantee of the returned /// mutable slice. `data` must be non-null and aligned even for zero-length -/// slices as with [`from_raw_parts`]. See the documentation of -/// [`from_raw_parts`] for more details. +/// slices as with [`from_raw_parts`]. The total size of the slice must be no +/// larger than `isize::MAX` **bytes** in memory. +/// +/// See the documentation of [`from_raw_parts`] for more details. /// /// [`from_raw_parts`]: ../../std/slice/fn.from_raw_parts.html #[inline] #[stable(feature = "rust1", since = "1.0.0")] pub unsafe fn from_raw_parts_mut<'a, T>(data: *mut T, len: usize) -> &'a mut [T] { debug_assert!(data as usize % mem::align_of::() == 0, "attempt to create unaligned slice"); - Repr { raw: FatPtr { data, len} }.rust_mut + debug_assert!(mem::size_of::().saturating_mul(len) <= isize::MAX as usize, + "attempt to create slice covering half the address space"); + Repr { raw: FatPtr { data, len } }.rust_mut } /// Converts a reference to T into a slice of length 1 (without copying).