AIKIDO-2026-540556

TL;DR

In Bytes and BytesMut, the internal reference-counted Shared structure is built by constructing it directly inside Box::new, so the Shared value takes ownership of the existing buffer before the heap allocation completes. If that allocation unwinds via a panic, which is possible when the global allocator is configured to panic instead of abort on allocation failure, the partially constructed Shared and the original owner are both dropped and free the same buffer, causing a double free. This affects the From<Vec> conversion, Bytes::shallow_clone_vec, and BytesMut::promote_to_shared. The fix allocates uninitialized memory first with MaybeUninit and only writes the Shared value after the allocation succeeds, so no partially initialized data is dropped on unwinding.