Closed
Description
Lines 622 to 640 in 9c05e39
usize::next_power_of_two()
method silently overflows to 0 in release mode. This makes it possible to shrink the size of the map to 0 with HeaderMap::reserve()
.
- If the map doesn't contain any entry, it sets the mask value to
usize::MAX
which is inconsistent but doesn't create any immediate harm. - If the map contains any entry, the code will call
self.grow(0)
and start infinite probing in this line.
Another problem is that the assertion for MAX_SIZE
doesn't exist here, so it is possible to grow the map larger than MAX_SIZE
.