A bug in the SmallVec::insert_many method caused it to allocate a buffer that was smaller than needed. It then wrote past the end of the buffer, causing a buffer overflow and memory corruption on the heap.

This bug was only triggered if the iterator passed to insert_many yielded more items than the lower bound returned from its size_hint method.

The flaw was corrected in smallvec 0.6.14 and 1.6.1, by ensuring that additional space is always reserved for each item inserted. The fix also simplified the implementation of insert_many to use less unsafe code, so it is easier to verify its correctness.

Thank you to Yechan Bae (@Qwaz) and the Rust group at Georgia Tech’s SSLab for finding and reporting this bug.

A Double Free / Use-After-Free (UAF) vulnerability has been identified in the IntoIter::drop and ThinVec::clear implementations of the thin-vec crate. Both vulnerabilities share the same root cause and can trigger memory corruption using only safe Rust code - no unsafe blocks required. Undefined Behavior has been confirmed via Miri and AddressSanitizer (ASAN).

Details

When a panic occurs during sequential element deallocation, the subsequent length cleanup code (set_len(0)) is never executed. During stack unwinding, the container is dropped again, causing already-freed memory to be re-freed (Double Free / UAF).

Vulnerability 1 - IntoIter::drop

IntoIter::drop transfers ownership of the internal buffer via mem::replace, then sequentially frees elements via ptr::drop_in_place. If a panic occurs during element deallocation, set_len_non_singleton(0) is never reached. During unwinding, vec is dropped again, re-freeing already-freed elements. The standard library's std::vec::IntoIter prevents this with a DropGuard pattern, but thin-vec lacks this defense.

PoC

use thin_vec::ThinVec;

struct PanicBomb(String);

impl Drop for PanicBomb {
    fn drop(&mut self) {
        if self.0 == "panic" {
            panic!("panic!");
        }
        println!("Dropping: {}", self.0);
    }
}

fn main() {
    let mut v = ThinVec::new();
    v.push(PanicBomb(String::from("normal1")));
    v.push(PanicBomb(String::from("panic")));  // trigger element
    v.push(PanicBomb(String::from("normal2")));

    let mut iter = v.into_iter();
    iter.next();
    // When iter is dropped: panic occurs at "panic" element
    // → During unwinding, Double Drop is triggered on "normal1" (already freed)
}

Vulnerability 2 - ThinVec::clear

clear() calls ptr::drop_in_place(&mut self[..]) followed by self.set_len(0) to reset the length. If a panic occurs during element deallocation, set_len(0) is never executed. When the ThinVec itself is subsequently dropped, already-freed elements are freed again.

PoC

use thin_vec::ThinVec;
use std::panic;

struct Poison(Box<usize>, &'static str);

impl Drop for Poison {
    fn drop(&mut self) {
        if self.1 == "panic" {
            panic!("panic!");
        }
        println!("Dropping: {}", self.0);
    }
}

fn main() {
    let mut v = ThinVec::new();
    v.push(Poison(Box::new(1), "normal1")); // index 0
    v.push(Poison(Box::new(2), "panic"));   // index 1 → panic triggered here
    v.push(Poison(Box::new(3), "normal2")); // index 2

    let _ = panic::catch_unwind(panic::AssertUnwindSafe(|| {
        v.clear();
        // panic occurs at "panic" element during clear()
        // → set_len(0) is never called
        // → already-freed elements are re-freed when v goes out of scope
    }));
}

Prerequisites

1. ThinVec stores heap-owning types (String, Vec, Box, etc.)
2. (Vulnerability 1) An iterator is created via into_iter() and dropped before being fully consumed, or (Vulnerability 2) clear() is called while a remaining element's Drop implementation can panic
3. The Drop implementation of a remaining element triggers a panic

When combined with Box<dyn Trait> types, an exploit primitive enabling Arbitrary Code Execution (ACE) via heap spray and vtable hijacking has been confirmed. If the freed fat pointer slot (16 bytes) at the point of Double Drop is reclaimed by an attacker-controlled fake vtable, subsequent Drop calls can be redirected to attacker-controlled code.