Vec::advance_mut can advance past the end of the buffer (#108)

src/buf/buf_mut.rs

@@ -713,7 +713,7 @@ impl BufMut for Vec<u8> {
         if cnt > remaining {
             // Reserve additional capacity, and ensure that the total length
             // will not overflow usize.
-            self.reserve(cnt - remaining);
+            self.reserve(cnt);
         }
 
         self.set_len(len + cnt);

tests/test_buf_mut.rs

@@ -49,6 +49,17 @@ fn test_put_u16() {
     assert_eq!(b"\x54\x21", &buf[..]);
 }
 
+#[test]
+fn test_vec_advance_mut() {
+    // Regression test for carllerche/bytes#108.
+    let mut buf = Vec::with_capacity(8);
+    unsafe {
+        buf.advance_mut(12);
+        assert_eq!(buf.len(), 12);
+        assert!(buf.capacity() >= 12, "capacity: {}", buf.capacity());
+    }
+}
+
 #[test]
 fn test_clone() {
     let mut buf = BytesMut::with_capacity(100);