Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fails to detect use after drop (after transmute) #1650

Closed
gmorenz opened this issue Dec 13, 2020 · 3 comments
Closed

Fails to detect use after drop (after transmute) #1650

gmorenz opened this issue Dec 13, 2020 · 3 comments

Comments

@gmorenz
Copy link

gmorenz commented Dec 13, 2020

I was surprised when miri failed to catch this, I'm not sure if it might just be considered out of scope for now?

use std::mem::transmute;

pub struct Test {
    b: bool,
}

impl Drop for Test {
    fn drop(&mut self) {
        self.b = false;
        println!("Dropping");
    }
}

fn main() {
    let test = Test{  b: true };
    let r = unsafe{ transmute::<&'_ bool, &'_ bool>(&test.b) };
    drop(test);
    println!("{:?}", *r);
}
@RalfJung
Copy link
Member

RalfJung commented Dec 13, 2020

There's no use-after-free here since there is no free as part of the drop.

There is a use-after-drop, but I think the game is still open whether that is UB in itself or not. (Of course it is UB for Box, but that will already be detected.)

We had a related issue somewhere that I currently cannot find... about marking memory as uninitialized on move.

@RalfJung
Copy link
Member

Ah, here is the related issue: rust-lang/unsafe-code-guidelines#188

So, given also that https://doc.rust-lang.org/reference/behavior-considered-undefined.html does not list "use-after-drop" or "use-after-move" as a form of UB in Rust, I think currently there is no bug in Miri here, so I am inclined to close this.

@gmorenz gmorenz changed the title Fails to detect user after free (after transmute) Fails to detect user after drop (after transmute) Dec 13, 2020
@gmorenz
Copy link
Author

gmorenz commented Dec 13, 2020

rust-lang/unsafe-code-guidelines#188 does seem exactly on point... so your inclination seems right to me.

@gmorenz gmorenz closed this as completed Dec 13, 2020
@gmorenz gmorenz changed the title Fails to detect user after drop (after transmute) Fails to detect use after drop (after transmute) Dec 13, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants