Skip to content

std: fix panic in Windows Stdin::read_vectored with pending surrogate#159134

Merged
rust-bors[bot] merged 1 commit into
rust-lang:mainfrom
rabindra789:fix-158096-stdin-panic
Jul 13, 2026
Merged

std: fix panic in Windows Stdin::read_vectored with pending surrogate#159134
rust-bors[bot] merged 1 commit into
rust-lang:mainfrom
rabindra789:fix-158096-stdin-panic

Conversation

@rabindra789

@rabindra789 rabindra789 commented Jul 11, 2026

Copy link
Copy Markdown
Contributor

Fixes #158096.

The small-buffer path in Stdin::read_vectored allocates a one-element UTF-16 scratch buffer before calling read_u16s_fixup_surrogates.

When a pending surrogate exists, read_u16s_fixup_surrogates needs temporary storage for both the buffered surrogate and one newly read UTF-16 code unit. The one-element buffer causes an out-of-bounds slice before ReadConsoleW is called.

Increase the scratch buffer to two UTF-16 code units, matching the function's requirements while leaving the normal read path unchanged.

@rustbot rustbot added S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. T-libs Relevant to the library team, which will review and decide on the PR/issue. labels Jul 11, 2026
@rustbot

rustbot commented Jul 11, 2026

Copy link
Copy Markdown
Collaborator

Thanks for the pull request, and welcome! The Rust Project is excited to review your changes, and you should hear from @Darksonn (or someone else) some time within the next two weeks.

Please see the contribution instructions for more information. Namely, in order to ensure the minimum review times lag, PR authors and assigned reviewers should ensure that the review label (S-waiting-on-review and S-waiting-on-author) stays updated, invoking these commands when appropriate:

  • @rustbot author: the review is finished, PR author should check the comments and take action accordingly
  • @rustbot review: the author is ready for a review, this PR will be queued again in the reviewer's queue
Why was this reviewer chosen?

The reviewer was selected based on:

  • Owners of files modified in this PR: @ChrisDenton, libs
  • @ChrisDenton, libs expanded to 13 candidates
  • Random selection from Darksonn, JohnTitor, Mark-Simulacrum, clarfonthey, jhpratt

@rustbot

This comment has been minimized.

The small-buffer path in Stdin::read allocates a one-element UTF-16
scratch buffer. When a pending surrogate exists,
read_u16s_fixup_surrogates requires temporary storage for both the
buffered surrogate and one newly read UTF-16 code unit.

Increase the scratch buffer to two UTF-16 code units so the surrogate
path can complete without panicking.
@rabindra789
rabindra789 force-pushed the fix-158096-stdin-panic branch from 0652710 to 5d637fd Compare July 11, 2026 14:17
@hkBst

hkBst commented Jul 11, 2026

Copy link
Copy Markdown
Member

You should consider adding a regression test.

@Darksonn

Copy link
Copy Markdown
Member

Yes please add a test.

@rustbot author

@rustbot rustbot removed the S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. label Jul 11, 2026
@rustbot

rustbot commented Jul 11, 2026

Copy link
Copy Markdown
Collaborator

Reminder, once the PR becomes ready for a review, use @rustbot ready.

@rustbot rustbot added the S-waiting-on-author Status: This is awaiting some action (such as code changes or more information) from the author. label Jul 11, 2026
@rabindra789

Copy link
Copy Markdown
Contributor Author

Sure, I'll add a ssimple regression test.

@rabindra789

Copy link
Copy Markdown
Contributor Author

@hkBst and @Darksonn Thanks! I looked into adding a regression test before making further changes.

The unit test I initially explored wasn't actually a valid regression test because it exercised read_u16s_fixup_surrogates directly with its own buffer. Reverting this one line fix wouldn't cause that test to fail, so I didn't think it was appropriate to submit.

I also looked through the existing Windows std test infrastructure, but I couldn't find a way to exercise the GetConsoleMode -> ReadConsoleW code path automatically.

Is there a preferred testing approach for this code path, or would manual verification be acceptable here?

@Darksonn

Copy link
Copy Markdown
Member

I guess we can't really test it due to #93055.

Can you confirm that you've tested this code manually?

@rabindra789

Copy link
Copy Markdown
Contributor Author

Yes. I manually verified the fix on Windows using a reproduction based on the program from #158096.

Before the change, the second read_vectored call panicked with:
range end index 2 out of range for slice of length 1

After increasing the scratch buffer from 1 to 2 UTF-16 code units, the same reproduction completed successfully without panicking.

@Darksonn

Copy link
Copy Markdown
Member

I've read the code and it makes sense to me.

@bors r+

@rust-bors

rust-bors Bot commented Jul 12, 2026

Copy link
Copy Markdown
Contributor

📌 Commit 5d637fd has been approved by Darksonn

It is now in the queue for this repository.

@rust-bors rust-bors Bot added S-waiting-on-bors Status: Waiting on bors to run and complete tests. Bors will change the label on completion. and removed S-waiting-on-author Status: This is awaiting some action (such as code changes or more information) from the author. labels Jul 12, 2026
@rabindra789

Copy link
Copy Markdown
Contributor Author

Thanks for taking the time to review it!

jhpratt added a commit to jhpratt/rust that referenced this pull request Jul 12, 2026
…, r=Darksonn

std: fix panic in Windows Stdin::read_vectored with pending surrogate

Fixes rust-lang#158096.

The small-buffer path in `Stdin::read_vectored` allocates a one-element UTF-16 scratch buffer before calling `read_u16s_fixup_surrogates`.

When a pending surrogate exists, `read_u16s_fixup_surrogates` needs temporary storage for both the buffered surrogate and one newly read UTF-16 code unit. The one-element buffer causes an out-of-bounds slice before `ReadConsoleW` is called.

Increase the scratch buffer to two UTF-16 code units, matching the  function's requirements while leaving the normal read path unchanged.
JonathanBrouwer added a commit to JonathanBrouwer/rust that referenced this pull request Jul 12, 2026
…, r=Darksonn

std: fix panic in Windows Stdin::read_vectored with pending surrogate

Fixes rust-lang#158096.

The small-buffer path in `Stdin::read_vectored` allocates a one-element UTF-16 scratch buffer before calling `read_u16s_fixup_surrogates`.

When a pending surrogate exists, `read_u16s_fixup_surrogates` needs temporary storage for both the buffered surrogate and one newly read UTF-16 code unit. The one-element buffer causes an out-of-bounds slice before `ReadConsoleW` is called.

Increase the scratch buffer to two UTF-16 code units, matching the  function's requirements while leaving the normal read path unchanged.
rust-bors Bot pushed a commit that referenced this pull request Jul 12, 2026
…uwer

Rollup of 7 pull requests

Successful merges:

 - #158732 (Apply MCP 1003 and move diagnostics.rs into its own module)
 - #159010 (Simplify the unwind crate)
 - #159131 (bootstrap: Allow path-based skipping of the coverage test suite)
 - #159134 (std: fix panic in Windows Stdin::read_vectored with pending surrogate)
 - #159178 (Print duration of BOLT instrumentation and optimization steps)
 - #159112 (Fix segfault in env access in statically linked FreeBSD binaries)
 - #159124 (compiletest: use VecDeque::pop_front_if)
rust-bors Bot pushed a commit that referenced this pull request Jul 12, 2026
…uwer

Rollup of 6 pull requests

Successful merges:

 - #158732 (Apply MCP 1003 and move diagnostics.rs into its own module)
 - #159131 (bootstrap: Allow path-based skipping of the coverage test suite)
 - #159134 (std: fix panic in Windows Stdin::read_vectored with pending surrogate)
 - #159178 (Print duration of BOLT instrumentation and optimization steps)
 - #159112 (Fix segfault in env access in statically linked FreeBSD binaries)
 - #159124 (compiletest: use VecDeque::pop_front_if)
@rust-bors
rust-bors Bot merged commit 2dcf77d into rust-lang:main Jul 13, 2026
13 checks passed
@rustbot rustbot added this to the 1.99.0 milestone Jul 13, 2026
rust-timer added a commit that referenced this pull request Jul 13, 2026
Rollup merge of #159134 - rabindra789:fix-158096-stdin-panic, r=Darksonn

std: fix panic in Windows Stdin::read_vectored with pending surrogate

Fixes #158096.

The small-buffer path in `Stdin::read_vectored` allocates a one-element UTF-16 scratch buffer before calling `read_u16s_fixup_surrogates`.

When a pending surrogate exists, `read_u16s_fixup_surrogates` needs temporary storage for both the buffered surrogate and one newly read UTF-16 code unit. The one-element buffer causes an out-of-bounds slice before `ReadConsoleW` is called.

Increase the scratch buffer to two UTF-16 code units, matching the  function's requirements while leaving the normal read path unchanged.
@rabindra789
rabindra789 deleted the fix-158096-stdin-panic branch July 13, 2026 03:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

S-waiting-on-bors Status: Waiting on bors to run and complete tests. Bors will change the label on completion. T-libs Relevant to the library team, which will review and decide on the PR/issue.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Windows console Stdin::read_vectored panics with a small first buffer and a pending surrogate

4 participants