Buffer overflow due to integer overflow #11
Description
[dependencies]
transpose = "0.2.2"fn main() {
let input = [0];
let mut output = input;
let width = (1 << (usize::BITS - 1)) + 1;
let height = width;
transpose::transpose(&input, &mut output, width, height);
}This panics on integer overflow in debug mode but results in a segmentation fault in release mode since overflows checks are off.
Current safety checks (fail on integer overflow):
assert_eq!(input_width*input_height, input.len());
assert_eq!(input_width*input_height, output.len());Possible new safety checks (catch integer overflow):
let area = input_width.checked_mul(input_height).expect("area overflow");
assert_eq!(area, input.len());
assert_eq!(area, output.len());Also transpose_inplace uses similar checks but doesn't have any unsafe.