Fix UB from incorrect Vec::set_len usage

src/lib.rs

@@ -3131,8 +3131,8 @@ impl Encoding {
             );
             unsafe {
                 let vec = string.as_mut_vec();
-                vec.set_len(valid_up_to);
                 core::ptr::copy_nonoverlapping(bytes.as_ptr(), vec.as_mut_ptr(), valid_up_to);
+                vec.set_len(valid_up_to);
             }
             (decoder, string, valid_up_to)
         } else {
@@ -3232,8 +3232,8 @@ impl Encoding {
             );
             unsafe {
                 let vec = string.as_mut_vec();
-                vec.set_len(valid_up_to);
                 core::ptr::copy_nonoverlapping(bytes.as_ptr(), vec.as_mut_ptr(), valid_up_to);
+                vec.set_len(valid_up_to);
             }
             (decoder, string, &bytes[valid_up_to..])
         } else {
@@ -3323,8 +3323,8 @@ impl Encoding {
             .next_power_of_two(),
         );
         unsafe {
-            vec.set_len(valid_up_to);
             core::ptr::copy_nonoverlapping(bytes.as_ptr(), vec.as_mut_ptr(), valid_up_to);
+            vec.set_len(valid_up_to);
         }
         let mut total_read = valid_up_to;
         let mut total_had_errors = false;
@@ -4074,16 +4074,13 @@ impl Decoder {
         dst: &mut String,
         last: bool,
     ) -> (CoderResult, usize, bool) {
-        unsafe {
-            let vec = dst.as_mut_vec();
-            let old_len = vec.len();
-            let capacity = vec.capacity();
-            vec.set_len(capacity);
-            let (result, read, written, replaced) =
-                self.decode_to_utf8(src, &mut vec[old_len..], last);
-            vec.set_len(old_len + written);
-            (result, read, replaced)
-        }
+        let vec = unsafe { dst.as_mut_vec() };
+        let old_len = vec.len();
+        let capacity = vec.capacity();
+        vec.resize(capacity, 0);
+        let (result, read, written, replaced) = self.decode_to_utf8(src, &mut vec[old_len..], last);
+        vec.truncate(old_len + written);
+        (result, read, replaced)
     }
 
     public_decode_function!(/// Incrementally decode a byte stream into UTF-8
@@ -4164,16 +4161,14 @@ impl Decoder {
         dst: &mut String,
         last: bool,
     ) -> (DecoderResult, usize) {
-        unsafe {
-            let vec = dst.as_mut_vec();
-            let old_len = vec.len();
-            let capacity = vec.capacity();
-            vec.set_len(capacity);
-            let (result, read, written) =
-                self.decode_to_utf8_without_replacement(src, &mut vec[old_len..], last);
-            vec.set_len(old_len + written);
-            (result, read)
-        }
+        let vec = unsafe { dst.as_mut_vec() };
+        let old_len = vec.len();
+        let capacity = vec.capacity();
+        vec.resize(capacity, 0);
+        let (result, read, written) =
+            self.decode_to_utf8_without_replacement(src, &mut vec[old_len..], last);
+        vec.truncate(old_len + written);
+        (result, read)
     }
 
     /// Query the worst-case UTF-16 output size (with or without replacement).
@@ -4665,15 +4660,13 @@ impl Encoder {
         dst: &mut Vec<u8>,
         last: bool,
     ) -> (CoderResult, usize, bool) {
-        unsafe {
-            let old_len = dst.len();
-            let capacity = dst.capacity();
-            dst.set_len(capacity);
-            let (result, read, written, replaced) =
-                self.encode_from_utf8(src, &mut dst[old_len..], last);
-            dst.set_len(old_len + written);
-            (result, read, replaced)
-        }
+        let old_len = dst.len();
+        let capacity = dst.capacity();
+        dst.resize(capacity, 0);
+        let (result, read, written, replaced) =
+            self.encode_from_utf8(src, &mut dst[old_len..], last);
+        dst.truncate(old_len + written);
+        (result, read, replaced)
     }
 
     /// Incrementally encode into byte stream from UTF-8 _without replacement_.
@@ -4705,15 +4698,13 @@ impl Encoder {
         dst: &mut Vec<u8>,
         last: bool,
     ) -> (EncoderResult, usize) {
-        unsafe {
-            let old_len = dst.len();
-            let capacity = dst.capacity();
-            dst.set_len(capacity);
-            let (result, read, written) =
-                self.encode_from_utf8_without_replacement(src, &mut dst[old_len..], last);
-            dst.set_len(old_len + written);
-            (result, read)
-        }
+        let old_len = dst.len();
+        let capacity = dst.capacity();
+        dst.resize(capacity, 0);
+        let (result, read, written) =
+            self.encode_from_utf8_without_replacement(src, &mut dst[old_len..], last);
+        dst.truncate(old_len + written);
+        (result, read)
     }
 
     /// Query the worst-case output size when encoding from UTF-16 with

src/mem.rs

@@ -2017,10 +2017,8 @@ pub fn decode_latin1<'a>(bytes: &'a [u8]) -> Cow<'a, str> {
     let (head, tail) = bytes.split_at(up_to);
     let capacity = head.len() + tail.len() * 2;
     let mut vec = Vec::with_capacity(capacity);
-    unsafe {
-        vec.set_len(capacity);
-    }
-    (&mut vec[..up_to]).copy_from_slice(head);
+    vec.extend(head);
+    vec.resize(capacity, 0);
     let written = convert_latin1_to_utf8(tail, &mut vec[up_to..]);
     vec.truncate(up_to + written);
     Cow::Owned(unsafe { String::from_utf8_unchecked(vec) })
@@ -2054,10 +2052,8 @@ pub fn encode_latin1_lossy<'a>(string: &'a str) -> Cow<'a, [u8]> {
     let (head, tail) = bytes.split_at(up_to);
     let capacity = bytes.len();
     let mut vec = Vec::with_capacity(capacity);
-    unsafe {
-        vec.set_len(capacity);
-    }
-    (&mut vec[..up_to]).copy_from_slice(head);
+    vec.extend(head);
+    vec.resize(capacity, 0);
     let written = convert_utf8_to_latin1_lossy(tail, &mut vec[up_to..]);
     vec.truncate(up_to + written);
     Cow::Owned(vec)