Use after free in core::iter::repeat_n

[jwong101]

core::iter::repeat_n currently unconditionally derives Clone. However,
it will also drop its inner object if n is 0, which can cause a UAF if it's cloned afterwards.

use std::rc::Rc;
fn main() {
    let mut c = [0; 100];
    let x = std::iter::repeat_n(Rc::new(0), 0);
    let y = Box::new(&mut c);
    for _ in 0..100 {
        _ = x.clone();
    }
    y.fill(0);
}

Running the above program segfaults:

Exited with signal 11 (SIGSEGV): segmentation violation
Standard Error
   Compiling playground v0.0.1 (/playground)
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 0.42s
     Running `target/debug/playground`

Edit: Made the segfault quicker/more reliable.

[lcnr]

same issue with its Debug implementation

fn main() {
    let x = std::iter::repeat_n(String::from("use after free"), 0);
    println!("{x:?}");
}

[m-ou-se]

cc @scottmcm, I think you implemented this. ^^

[apiraino]

WG-prioritization assigning priority (Zulip discussion).

@rustbot label -I-prioritize +P-critical