From 29daea95b91046c1d18cdc738cec4f639ec2661e Mon Sep 17 00:00:00 2001
From: "Sergey \"Shnatsel\" Davidoff" <shnatsel@gmail.com>
Date: Sun, 3 May 2026 09:40:56 +0100
Subject: [PATCH] Fix double-free for ZSTs with Drop in .extend()

---
 src/arrayvec.rs | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/arrayvec.rs b/src/arrayvec.rs
index e5ea52d..bd08e1c 100644
--- a/src/arrayvec.rs
+++ b/src/arrayvec.rs
@@ -1137,6 +1137,11 @@ impl<T, const CAP: usize> ArrayVec<T, CAP> {
                 debug_assert_ne!(ptr, end_ptr);
                 if mem::size_of::<T>() != 0 {
                     ptr.write(elt);
+                } else {
+                    // The ZST element has logically been moved into the vector.
+                    // There is no memory to write, but dropping `elt` here would
+                    // drop it once now and once again when the vector is dropped.
+                    mem::forget(elt);
                 }
                 ptr = raw_ptr_add(ptr, 1);
                 guard.data += 1;