-
Couldn't load subscription status.
- Fork 13.9k
Description
An iterator created by BTreeMap::range, BTreeMap::range_mut and BTreeSet::range can wander off of the underlying data and segfault. It is caused by supplying an upper bound that is lower than the lower bound and there is an element between them.
Code to reproduce: http://is.gd/HoNWLH
tested also locally on rustc 1.10.0-nightly (b5ba5923f 2016-04-21).
The iterator ends when the iterated element equals to the upper bound: https://doc.rust-lang.org/src/collections/up/src/libcollections/btree/map.rs.html#898-908. If the upper bound is lower than the lower bound, this condition is never met. This is not checked for while creating the iterator in https://doc.rust-lang.org/src/collections/up/src/libcollections/btree/map.rs.html#464-588.