From 0aecf3c74b7fd09460f453e7e95ae8cb65a92440 Mon Sep 17 00:00:00 2001
From: CAD97 <cad97@cad97.com>
Date: Tue, 30 Jun 2020 12:42:09 -0400
Subject: [PATCH] Fix invalid pointer deref in Weak::as_ptr

---
 src/liballoc/rc.rs   | 2 +-
 src/liballoc/sync.rs | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/liballoc/rc.rs b/src/liballoc/rc.rs
index 8f7b8efd811f7..ab64d5330874f 100644
--- a/src/liballoc/rc.rs
+++ b/src/liballoc/rc.rs
@@ -1711,7 +1711,7 @@ impl<T> Weak<T> {
         // because dangling weaks are only created for sized T. wrapping_offset
         // is used so that we can use the same code path for dangling weak refs.
         unsafe {
-            let offset = data_offset(&raw const (*ptr).value);
+            let offset = data_offset(fake_ptr);
             set_data_ptr(fake_ptr, (ptr as *mut u8).wrapping_offset(offset))
         }
     }
diff --git a/src/liballoc/sync.rs b/src/liballoc/sync.rs
index 27c36f4a56933..e9af80d326f44 100644
--- a/src/liballoc/sync.rs
+++ b/src/liballoc/sync.rs
@@ -1479,7 +1479,7 @@ impl<T> Weak<T> {
         // because dangling weaks are only created for sized T. wrapping_offset
         // is used so that we can use the same code path for dangling weak refs.
         unsafe {
-            let offset = data_offset(&raw const (*ptr).data);
+            let offset = data_offset(fake_ptr);
             set_data_ptr(fake_ptr, (ptr as *mut u8).wrapping_offset(offset))
         }
     }