get_slices: panic if GuestMemoryRegion violates contract

Panic in get_slices() if the call to .get_slice() returns a slice that
does not match the `len` parameter passed to it. If this happens there
is an application bug somewhere in the GuestMemoryRegion implementation,
and the library code in vm-memory, while not doing anything unsound,
will probably react unpredictably to this situation.

This way, the final paragraph in the get_slices() documentatoin about
cumulative lengths is actually true.

Signed-off-by: Patrick Roy <[email protected]>

Author: roypat

src/guest_memory.rs

@@ -525,7 +525,13 @@ impl<'a, M: GuestMemory + ?Sized> GuestMemorySliceIterator<'a, M> {
             (_, true) => return Some(Err(Error::GuestAddressOverflow)),
         };
 
-        Some(region.get_slice(start, len))
+        Some(region.get_slice(start, len).inspect(|s| {
+            assert_eq!(
+                s.len(),
+                len,
+                "get_slice() returned a slice with wrong length"
+            )
+        }))
     }
 }