Version
http 1.5.0
Platform
Linux x86_64
Summary
size_hint may return 1 when the iterator actually has 0 elements left.
the implementation should provide a correct estimation, because otherwise it would be a violation of the trait’s protocol.
https://doc.rust-lang.org/std/iter/trait.Iterator.html#method.size_hint
This is likely not security-relevant, because this hint
must not be trusted to e.g., omit bounds checks in unsafe code
Code Sample
// Cargo.toml: http = "=1.5.0"
fn main() {
let mut m: http::HeaderMap<http::HeaderValue> = Default::default();
m.insert(http::header::HOST, http::HeaderValue::from_static("x"));
let mut it = m.iter();
let (lo, _) = std::iter::Iterator::size_hint(&it); let a = it.next(); // (1,_), Some
let (lo, _) = std::iter::Iterator::size_hint(&it); let b = it.next(); // (1,_), None ← bug
assert!(!(lo >= 1 && b.is_none()), "size_hint lower bound {lo} > 0 but next() == None");
let _ = a;
}
Expected Behavior
size_hint is accurate
Actual Behavior
it is not accurate
Additional Context
Bug found by a fuzzer I'm working on, minimal repro from Claude. Please let me know if this bug isn't helpful, and how I can do better. Thank you for maintaining such a foundational crate!
Version
http 1.5.0
Platform
Linux x86_64
Summary
size_hintmay return 1 when the iterator actually has 0 elements left.https://doc.rust-lang.org/std/iter/trait.Iterator.html#method.size_hint
This is likely not security-relevant, because this hint
Code Sample
Expected Behavior
size_hintis accurateActual Behavior
it is not accurate
Additional Context
Bug found by a fuzzer I'm working on, minimal repro from Claude. Please let me know if this bug isn't helpful, and how I can do better. Thank you for maintaining such a foundational crate!