-
Notifications
You must be signed in to change notification settings - Fork 13.6k
Closed
Labels
A-GATsArea: Generic associated types (GATs)Area: Generic associated types (GATs)C-bugCategory: This is a bug.Category: This is a bug.F-generic_associated_types`#![feature(generic_associated_types)]` a.k.a. GATs`#![feature(generic_associated_types)]` a.k.a. GATsI-unsoundIssue: A soundness hole (worst kind of bug), see: https://en.wikipedia.org/wiki/SoundnessIssue: A soundness hole (worst kind of bug), see: https://en.wikipedia.org/wiki/SoundnessT-compilerRelevant to the compiler team, which will review and decide on the PR/issue.Relevant to the compiler team, which will review and decide on the PR/issue.requires-nightlyThis issue requires a nightly compiler in some way.This issue requires a nightly compiler in some way.
Description
It looks like Generic Associated Types aren't validated on whether the specified type on the impl-side indeed implements the traits as written down in the definition of the associated type.
The following program shows a use-after-free of a String:
#![feature(generic_associated_types)]
trait UnsafeCopy {
type Item<'a>: Copy;
fn copy<'a>(item: &Self::Item<'a>) -> Self::Item<'a> {
*item
}
}
impl <T> UnsafeCopy for T {
type Item<'a> = T;
}
fn main() {
let mut s = String::from("Hello world!");
let copy = String::copy(&s);
// Do we indeed point to the samme memory?
assert!(s.as_ptr() == copy.as_ptr());
// Any use of `copy` is certeinly UB after this
drop(s);
// UB UB UB UB UB!!
println!("{}", copy);
}
schneiderfelipe
Metadata
Metadata
Assignees
Labels
A-GATsArea: Generic associated types (GATs)Area: Generic associated types (GATs)C-bugCategory: This is a bug.Category: This is a bug.F-generic_associated_types`#![feature(generic_associated_types)]` a.k.a. GATs`#![feature(generic_associated_types)]` a.k.a. GATsI-unsoundIssue: A soundness hole (worst kind of bug), see: https://en.wikipedia.org/wiki/SoundnessIssue: A soundness hole (worst kind of bug), see: https://en.wikipedia.org/wiki/SoundnessT-compilerRelevant to the compiler team, which will review and decide on the PR/issue.Relevant to the compiler team, which will review and decide on the PR/issue.requires-nightlyThis issue requires a nightly compiler in some way.This issue requires a nightly compiler in some way.