Matthew House

`run_closure` and `drop_closure` unsoundly drop payload on panic

5

### Bug Description These two functions use `catch_unwind` to catch panics and transfer them as Python exceptions (for `run_closure`) or just report them (for `drop_closure`). However, both functions drop the...

`emacs` v0.18.0 was released with commit a9b573c3ef443e9adf04cfc349ac7b3bc91b28e2. However, the `0.18.0` tag on this repo points to commit fbb0c7af210b50fdacbce809567e3995c6cc1d2c, the commit for v0.17.0. It should probably be changed to the former.

#95295 causes unsoundness in multiple existing crates

5

I was recently looking through the draft release notes when I noticed #95295. While it makes sense for `Layout::from_size_align()` to restrict allocations to `isize::MAX` bytes, this restriction was also added...

`println!()` can cause panic outside `catch_unwind()`

1

The `miniz_oxide_c_api` wrappers in `src/lib.rs` call `println!("FATAL ERROR: Caught panic!");` when a panic is caught. `println!()` can panic if it fails to write, causing UB if `panic = "abort"` is...

In 41.1.1, "`inline` for Speed—Maybe", you write: > Another way is to declare the function as `extern inline`. This will attempt to inline in this file, but will also create...

`thread_id` overflow protection is insufficient

4

`thread_id::next()` uses `NonZeroUsize::new()` to guard against overflow. However, its current behavior of simply raising a panic is insufficient for soundness: if the panic is ignored (through `catch_unwind()` or by running...

Comments in stream data

34

In ISO 32000-2:2020, 7.2.4 states, > Any occurrence of the PERCENT SIGN (25h) outside a string or inside a content stream (see 7.8.2, "Content streams") introduces a comment. This implies...

This commit updates the list of TypedArray internal slots in `#sec-typedarray-exotic-objects` and `#sec-properties-of-typedarray-instances` to match the list of slots added by `TypedArrayCreate`.