std: fix Xous UDP recv length over-report and OOB panic by devnexen · Pull Request #159523 · rust-lang/rust

devnexen · 2026-07-18T15:10:37Z

recv_inner returned the datagram length instead of the bytes copied into the caller's buffer, and rxlen >= 4075 could index past the receive buffer and panic. Clamp the count to both buffers, as in #158928.

rustbot · 2026-07-18T15:10:42Z

r? @Darksonn

rustbot has assigned @Darksonn.
They will have a look at your PR within the next two weeks and either review your PR or reassign to another reviewer.

Use r? to explicitly pick a reviewer

Why was this reviewer chosen?

The reviewer was selected based on:

Owners of files modified in this PR: @ChrisDenton, libs
@ChrisDenton, libs expanded to 13 candidates
Random selection from 6 candidates

workingjubilee · 2026-07-19T02:36:48Z

Can you address the thing that rustbot mentioned?

Darksonn · 2026-07-21T09:31:17Z

+                for (&s, d) in rr[22..22 + max].iter().zip(buf.iter_mut()) {
                    *d = s;
                }


Could we do this?

Suggested change

for (&s, d) in rr[22..22 + max].iter().zip(buf.iter_mut()) {

*d = s;

}

buf.copy_from_slice(&rr[22..22 + max]);

And if so, then what about this?

Suggested change

for (&s, d) in rr[22..22 + max].iter().zip(buf.iter_mut()) {

*d = s;

}

buf.copy_from_slice(&rr[22..][..max]);

View changes since the review

good point albeit I took a slightly different approach as both slices would need to be of the same length.

Darksonn · 2026-07-21T09:33:37Z

@rustbot author

rustbot · 2026-07-21T09:33:42Z

Reminder, once the PR becomes ready for a review, use @rustbot ready.

recv_inner returned the datagram length instead of the bytes copied into the caller's buffer, and rxlen >= 4075 could index past the receive buffer and panic. Clamp the count to both buffers, mirroring the earlier send_to fix.

devnexen · 2026-07-21T10:30:43Z

@rustbot ready

Darksonn · 2026-07-22T08:24:19Z

Can we add a test for this? I'm not sure if we run tests for this target.

devnexen · 2026-07-22T11:09:17Z

Can we add a test for this? I'm not sure if we run tests for this target.

Nope, it is tier 3, no CI job, and the target docs say the test suite isn't supported. The module is gated on target_os = "xous", so a test there would never be compiled, and the buffer comes straight from a lend_mut syscall.

Darksonn

Thanks.

@bors r+

View changes since this review

rust-bors · 2026-07-22T15:58:26Z

📌 Commit bb4f000 has been approved by Darksonn

It is now in the queue for this repository.

std: fix Xous UDP recv length over-report and OOB panic recv_inner returned the datagram length instead of the bytes copied into the caller's buffer, and rxlen >= 4075 could index past the receive buffer and panic. Clamp the count to both buffers, as in rust-lang#158928.

Rollup of 8 pull requests Successful merges: - #159504 (Abort const-eval queries early when there are generics in the type) - #159523 (std: fix Xous UDP recv length over-report and OOB panic) - #159605 (Add fallback for `intrinsics::fabs`) - #159699 (bump std libc to 0.2.189) - #159306 (Add new variant to iterating-updating-mutref borrowck test) - #159346 (fs::hard_link: use linkat on Android) - #159513 (Consider `()` as suspicious only when expecting `!` for runtime symbols) - #159734 (Document the link_section attribute)

Rollup merge of #159523 - devnexen:xous_upd_fix_2, r=Darksonn std: fix Xous UDP recv length over-report and OOB panic recv_inner returned the datagram length instead of the bytes copied into the caller's buffer, and rxlen >= 4075 could index past the receive buffer and panic. Clamp the count to both buffers, as in #158928.

Rollup of 8 pull requests Successful merges: - rust-lang/rust#159504 (Abort const-eval queries early when there are generics in the type) - rust-lang/rust#159523 (std: fix Xous UDP recv length over-report and OOB panic) - rust-lang/rust#159605 (Add fallback for `intrinsics::fabs`) - rust-lang/rust#159699 (bump std libc to 0.2.189) - rust-lang/rust#159306 (Add new variant to iterating-updating-mutref borrowck test) - rust-lang/rust#159346 (fs::hard_link: use linkat on Android) - rust-lang/rust#159513 (Consider `()` as suspicious only when expecting `!` for runtime symbols) - rust-lang/rust#159734 (Document the link_section attribute)

rustbot assigned Darksonn Jul 18, 2026

rustbot added S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. T-libs Relevant to the library team, which will review and decide on the PR/issue. labels Jul 18, 2026

This comment has been minimized.

Sign in to view

workingjubilee added the O-xous OS: A microkernel OS for privacy in computing label Jul 19, 2026

devnexen force-pushed the xous_upd_fix_2 branch from b46559d to c3ace5c Compare July 19, 2026 03:56

Darksonn reviewed Jul 21, 2026

View reviewed changes

rustbot added S-waiting-on-author Status: This is awaiting some action (such as code changes or more information) from the author. and removed S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. labels Jul 21, 2026

std: fix Xous UDP recv length over-report and OOB panic

bb4f000

recv_inner returned the datagram length instead of the bytes copied into the caller's buffer, and rxlen >= 4075 could index past the receive buffer and panic. Clamp the count to both buffers, mirroring the earlier send_to fix.

devnexen force-pushed the xous_upd_fix_2 branch from c3ace5c to bb4f000 Compare July 21, 2026 10:16

rustbot added S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. and removed S-waiting-on-author Status: This is awaiting some action (such as code changes or more information) from the author. labels Jul 21, 2026

Darksonn approved these changes Jul 22, 2026

View reviewed changes

rust-bors Bot added S-waiting-on-bors Status: Waiting on bors to run and complete tests. Bors will change the label on completion. and removed S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. labels Jul 22, 2026

JonathanBrouwer mentioned this pull request Jul 22, 2026

Rollup of 7 pull requests #159741

Closed

JonathanBrouwer mentioned this pull request Jul 22, 2026

Rollup of 7 pull requests #159742

Closed

GuillaumeGomez mentioned this pull request Jul 22, 2026

Rollup of 9 pull requests #159747

Closed

GuillaumeGomez mentioned this pull request Jul 22, 2026

Rollup of 8 pull requests #159748

Merged

rust-bors Bot merged commit f42a267 into rust-lang:main Jul 23, 2026
13 checks passed

rustbot added this to the 1.99.0 milestone Jul 23, 2026

Uh oh!

Uh oh!

Conversation

devnexen commented Jul 18, 2026 • edited by rustbot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

rustbot commented Jul 18, 2026

Uh oh!

This comment has been minimized.

workingjubilee commented Jul 19, 2026

Uh oh!

Darksonn Jul 21, 2026 • edited by rustbot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

devnexen Jul 21, 2026

Choose a reason for hiding this comment

Uh oh!

Darksonn commented Jul 21, 2026

Uh oh!

rustbot commented Jul 21, 2026

Uh oh!

devnexen commented Jul 21, 2026

Uh oh!

Darksonn commented Jul 22, 2026

Uh oh!

devnexen commented Jul 22, 2026

Uh oh!

Darksonn left a comment • edited by rustbot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

rust-bors Bot commented Jul 22, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

devnexen commented Jul 18, 2026 •

edited by rustbot

Loading

Darksonn Jul 21, 2026 •

edited by rustbot

Loading

Darksonn left a comment •

edited by rustbot

Loading