zeroize: avoid double-zeroizing Vec's initialized elements - #1525
Open
Johnsonajibi wants to merge 1 commit into
Open
zeroize: avoid double-zeroizing Vec's initialized elements#1525Johnsonajibi wants to merge 1 commit into
Johnsonajibi wants to merge 1 commit into
Conversation
Vec<Z>::zeroize() zeroized the initialized elements via iter_mut(), then called clear() (which resets len to 0), then zeroized spare_capacity_mut(). Since spare_capacity_mut() covers everything beyond len, and len was already 0 at that point, it covered the entire allocation - re-zeroizing the elements that were already zeroized in the first step. Reorder so the spare (truly uninitialized) capacity is zeroed first, while len still reflects the real element count, so the two zeroing passes cover disjoint ranges. Behavior is unchanged (the full allocation is still zeroed) other than removing the redundant work; existing tests (including zeroize_vec_entire_capacity, which checks no partially-zeroized or uninitialized data survives) still pass. Fixes RustCrypto#1524
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #1524.
Vec<Z>::zeroize()currently:iter_mut()clear(), which resetslento 0spare_capacity_mut()Since
spare_capacity_mut()covers everything beyondlen, andlenis already 0 by step 3, it covers the entire allocation - re-zeroizing the elements that were already zeroized in step 1.This PR reorders the operations so the spare (truly uninitialized) capacity is zeroed first, while
lenstill reflects the real element count. The two zeroing passes then cover disjoint ranges instead of overlapping.Behavior is unchanged - the full allocation is still zeroed - only the redundant work is removed. Verified locally with
cargo test --features alloc: all existing tests pass, includingzeroize_vec_entire_capacity, which specifically checks that no partially-zeroized or uninitialized data survives (this test's ordering-sensitive assertions still hold under the new order - traced through manually and confirmed via the test run).