`SizeHint` addition overflows (panics in debug builds, wraps in release)

Open Beginner friendly
  • Is something wrong?
#183 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
78/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
rust
Domain
backend-api-design

Research direction

The issue points to src/size_hint.rs, where Add for SizeHint overflows while combining bounds. Read that implementation and its nearby tests first, then check how the proposed saturating lower bound and checked upper bound fit the existing behavior. Done means overflowing additions no longer panic or wrap, and tests cover the resulting bounds.

Written by the indexing model from the issue text.

Description

impl Add for SizeHint adds the lower and upper bounds with plain +, so it panics with "attempt to add with overflow" in debug builds when a sum exceeds u64::MAX. In release builds it wraps, and the result can be a hint whose bounds are smaller than either input.

// Cargo.toml: http-body = { git = "https://github.com/hyperium/http-body" }
use http_body::SizeHint;

fn main() {
    let s = SizeHint::with_exact(u64::MAX) + SizeHint::with_exact(1);
    println!("{:?} {:?}", s.lower(), s.upper());
}

Debug build:

thread 'main' panicked at http-body/src/size_hint.rs:95:20:
attempt to add with overflow

Release build: prints 0 Some(0).

I expected the sum to saturate at u64::MAX (a size hint that cannot be represented exactly is still a valid lower bound when saturated), or the overflow to be documented. Checked on master at c6ca645.

fn add(self, rhs: Self) -> Self::Output {
    SizeHint {
        lower: self.lower() + rhs.lower(),                                   // overflows
        upper: self.upper().and_then(|this| rhs.upper().map(|rhs| this + rhs)), // overflows
    }
}

Suggested fix: self.lower().saturating_add(rhs.lower()), and for the upper bound checked_add, giving None (no upper bound) when the sum does not fit.

Kani harness that fails on master (cargo kani --harness add_does_not_overflow, appended to src/size_hint.rs):

#[cfg(kani)]
mod kani_proofs {
    use super::SizeHint;

    #[kani::proof]
    fn add_does_not_overflow() {
        let a = SizeHint::with_exact(kani::any());
        let b = SizeHint::with_exact(kani::any());
        let _ = a + b;
    }
}

Failed Checks: attempt to add with overflow
 File: "src/size_hint.rs", line 95, in <size_hint::SizeHint as std::ops::Add>::add
VERIFICATION:- FAILED

It takes about 1.6 s and under 200 MB.

This was found with Kani 0.68.0 in an experiment where AI agents verified popular crates using the Kani agent plugin (model-checking/kani#5059). The text was written with AI assistance; the reproducer and the Kani harness were re-run by hand on the commit named above.

Dominant language
Rust
Stars
173
Forks
71
Avg merge
1d 12h
Merged PRs (30d)
1

Getting set up

This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from hyperium/http-body

All issues in hyperium/http-body

Similar issues

More Rust issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.