3 * size_of::<usize>
because of metadata write operations.Heap::extend
with a size smaller than two usize
s (e.g., 16 on x86_64
), the size was erroneously rounded up to the minimum size, which could result in an out-of-bounds write.Heap::extend
on an empty heap tried to construct a heap starting at address 0, which is also an out-of-bounds write.
Heap::new
(or a similar constructor) with a heap size that is smaller than two usize
s. This was treated as an empty heap as well.Heap::extend
on a heap whose size is not a multiple of the size of two usize
s resulted in unaligned writes. It also left the heap in an unexpected state, which might lead to subsequent issues. We did not find a way to exploit this undefined behavior yet (apart from DoS on platforms that fault on unaligned writes).