Add a zeroize feature to erase SmallVec contents

Cargo.toml

@@ -36,6 +36,7 @@ rayon = ["std", "dep:rayon"]
 serde = ["dep:serde_core"]
 specialization = []
 std = []
+zeroize = ["dep:zeroize"]
 
 [dependencies]
 allocator-api2 = { version = "0.4", optional = true, features = ["alloc"], default-features = false }
@@ -46,6 +47,7 @@ defmt = { version = "1.1", optional = true, default-features = false }
 encase = { version = "0.13", optional = true, default-features = false }
 rayon = { version = "1.12", optional = true, default-features = false }
 serde_core = { version = "1.0", optional = true, default-features = false }
+zeroize = { version = "1.9", optional = true, default-features = false }
 malloc_size_of = { version = "0.1", optional = true, default-features = false }
 
 [dev-dependencies]
@@ -81,6 +83,10 @@ required-features = ["serde"]
 name = "std"
 required-features = ["std"]
 
+[[test]]
+name = "zeroize"
+required-features = ["zeroize"]
+
 [[bench]]
 name = "bench"
 path = "benches/bench.rs"

README.md

@@ -65,6 +65,7 @@ v.sort();
 - `specialization` (nightly): enables specialization,
  improving performance on some cases
 - `std`: implements the `std::io::Write` type for `SmallVec<u8, N>`
+- `zeroize`: implements `zeroize::Zeroize`, erasing elements and storage
 
 > [!NOTE]
 >

src/lib.rs

@@ -55,6 +55,8 @@ use defmt::{
 pub use errors::SmallVecError;
 #[cfg(feature = "std")]
 use std::io;
+#[cfg(feature = "zeroize")]
+use zeroize::Zeroize;
 use {
     allocator::{
         Allocator,
@@ -1796,6 +1798,22 @@ impl<T: Debug, const N: usize, A: Allocator> Debug for SmallVec<T, N, A> {
     }
 }
 
+#[cfg(feature = "zeroize")]
+impl<T: Zeroize, const N: usize, A: Allocator> Zeroize for SmallVec<T, N, A> {
+    fn zeroize(&mut self) {
+        // Wipe the spare capacity before `clear` resets the length to zero,
+        // otherwise it would cover the whole allocation and wipe the elements
+        // a second time.
+        self.spare_capacity_mut().zeroize();
+
+        // Zeroize the elements in place so nested allocations, such as a
+        // `String`'s heap buffer, are wiped before they are dropped.
+        self.iter_mut().zeroize();
+
+        self.clear();
+    }
+}
+
 #[cfg(feature = "arbitrary")]
 #[cfg_attr(docsrs, doc(cfg(feature = "arbitrary")))]
 impl<'a, T, const N: usize> arbitrary::Arbitrary<'a> for SmallVec<T, N, Global>

tests/zeroize.rs

@@ -0,0 +1,56 @@
+use {
+    smallvec::SmallVec,
+    zeroize::Zeroize
+};
+
+fn assert_fully_zeroed<const N: usize>(v: &mut SmallVec<u8, N>) {
+    assert!(v.is_empty());
+    assert!(
+        v.spare_capacity_mut()
+            .iter()
+            .all(|slot| unsafe { slot.assume_init() } == 0)
+    );
+}
+
+#[test]
+fn zeroize_inline() {
+    let mut v: SmallVec<u8, 8> = SmallVec::from([1, 2, 3, 4]);
+    v.push(5);
+    assert!(!v.spilled());
+
+    v.zeroize();
+
+    assert_eq!(v.capacity(), 8);
+    assert_fully_zeroed(&mut v);
+
+    // It is still usable.
+    v.extend_from_slice(&[1, 2, 3]);
+    assert_eq!(v.as_slice(), &[1, 2, 3]);
+}
+
+#[test]
+fn zeroize_spilled() {
+    let mut v: SmallVec<u8, 8> = SmallVec::from([1, 2, 3, 4, 5, 6, 7, 8]);
+    v.push(9);
+    assert!(v.spilled());
+    let capacity = v.capacity();
+
+    v.zeroize();
+
+    assert!(v.spilled());
+    assert_eq!(v.capacity(), capacity);
+    assert_fully_zeroed(&mut v);
+
+    v.extend_from_slice(&[10, 11]);
+    assert_eq!(v.as_slice(), &[10, 11]);
+}
+
+#[test]
+fn zeroize_empty() {
+    let mut v: SmallVec<u8, 4> = SmallVec::new();
+
+    v.zeroize();
+
+    assert_eq!(v.capacity(), 4);
+    assert_fully_zeroed(&mut v);
+}