fix pointer invalidation when extnding a vector from an untrusted iterator

diff --git a/src/liballoc/vec.rs b/src/liballoc/vec.rs
index 361ce20376daef46fc9a801b0f2ce321b8deae22..6f264399fa884e594c721f277eac43c274862687 100644 (file)
--- a/src/liballoc/vec.rs
+++ b/src/liballoc/vec.rs
@@ -2019,6 +2019,8 @@ impl<T, I> SpecExtend<T, I> for Vec<T>
                 let (lower, _) = iterator.size_hint();
                 let mut vector = Vec::with_capacity(lower.saturating_add(1));
                 unsafe {
+                    // `vector` is new, cannot have aliases, so us getting exclusive references
+                    // here is okay.
                     ptr::write(vector.get_unchecked_mut(0), element);
                     vector.set_len(1);
                 }
@@ -2145,7 +2147,7 @@ fn extend_desugared<I: Iterator<Item = T>>(&mut self, mut iterator: I) {
                 self.reserve(lower.saturating_add(1));
             }
             unsafe {
-                ptr::write(self.get_unchecked_mut(len), element);
+                ptr::write(self.as_mut_ptr().add(len), element);
                 // NB can't overflow since we would have had to alloc the address space
                 self.set_len(len + 1);
             }