Closed
Description
An iterator created by BTreeMap::range
, BTreeMap::range_mut
and BTreeSet::range
can wander off of the underlying data and segfault. It is caused by supplying an upper bound that is lower than the lower bound and there is an element between them.
Code to reproduce: http://is.gd/HoNWLH
tested also locally on rustc 1.10.0-nightly (b5ba5923f 2016-04-21)
.
The iterator ends when the iterated element equals to the upper bound: https://doc.rust-lang.org/src/collections/up/src/libcollections/btree/map.rs.html#898-908. If the upper bound is lower than the lower bound, this condition is never met. This is not checked for while creating the iterator in https://doc.rust-lang.org/src/collections/up/src/libcollections/btree/map.rs.html#464-588.