Zip may call __iterator_get_unchecked twice with the same index
Here __iterator_get_unchecked is called for potential side effects until self.index == self.a.size(), ignoring however that it could have already been called in next_back with those indexes.
| } else if A::may_have_side_effect() && self.index < self.a.size() { | |
| let i = self.index; | |
| self.index += 1; | |
| // match the base implementation's potential side effects | |
| // SAFETY: we just checked that `i` < `self.a.len()` | |
| unsafe { | |
| self.a.__iterator_get_unchecked(i); | |
| } | |
| None |
Playground link that demonstrates how this can be exploited to get two mutable references to the same data and cause an use-after-free bug.