Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Heads-up: UB due to misuse of mem::zeroed will soon lead to panic #1

Closed
RalfJung opened this issue Aug 31, 2020 · 3 comments
Closed

Comments

@RalfJung
Copy link

RalfJung commented Aug 31, 2020

Here, this crate causes UB by "Producing an invalid value". Concretely, it creates an arbitrary T with mem::zeroed(). In the near future the call to mem::zeroed() will panic to avoid UB, and our crater run determined that this crate will be affected. (Specifically, the test suite of this crate creates a zero-initialized String, which is invalid.)

Maybe a good replacement is MaybeUninit, which tracks the possibility of uninitialized values at the type level to make sure the compiler does not make any false assumptions.

@John-Nagle
Copy link

And, sure enough, almost two years later, running the example from the documentation:

cargo run
    Finished dev [unoptimized + debuginfo] target(s) in 0.02s
     Running `target/debug/memo`
thread 'main' panicked at 'attempted to zero-initialize type `alloc::string::String`, which is invalid', /home/john/.cargo/registry/src/github.com-1ecc6299db9ec823/memoization-0.1.0/src/lib.rs:189:48
stack backtrace:
   0: rust_begin_unwind
             at /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/std/src/panicking.rs:584:5
   1: core::panicking::panic_fmt
             at /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/core/src/panicking.rs:143:14
   2: core::panicking::panic
             at /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/core/src/panicking.rs:48:5
   3: core::mem::zeroed
             at /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/core/src/mem/mod.rs:642:9
   4: <memoization::Memoized<I,O,Func> as core::ops::deref::DerefMut>::deref_mut
             at /home/john/.cargo/registry/src/github.com-1ecc6299db9ec823/memoization-0.1.0/src/lib.rs:189:48
   5: memo::main
             at ./src/main.rs:19:3
   6: core::ops::function::FnOnce::call_once
             at /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/core/src/ops/function.rs:227:5
note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.
john@Nagle-LTS:~/projects/rustcode/memo$ 

@John-Nagle
Copy link

And the crate now fails its own tests:

failures:

---- test::test_memoized_2 stdout ----
thread 'test::test_memoized_2' panicked at 'attempted to zero-initialize type `alloc::string::String`, which is invalid', src/lib.rs:152:48
stack backtrace:
   0: rust_begin_unwind
             at /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/std/src/panicking.rs:584:5
   1: core::panicking::panic_fmt
             at /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/core/src/panicking.rs:143:14
   2: core::panicking::panic
             at /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/core/src/panicking.rs:48:5
   3: core::mem::zeroed
             at /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/core/src/mem/mod.rs:642:9
   4: <memoization::Memoized<I,O,Func> as core::ops::deref::DerefMut>::deref_mut
             at ./src/lib.rs:152:48
   5: memoization::test::test_memoized_2
             at ./src/lib.rs:196:9
   6: memoization::test::test_memoized_2::{{closure}}
             at ./src/lib.rs:190:5
   7: core::ops::function::FnOnce::call_once
             at /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/core/src/ops/function.rs:227:5
   8: core::ops::function::FnOnce::call_once
             at /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/core/src/ops/function.rs:227:5
note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.

---- test::test_testing_pattern stdout ----
thread 'test::test_testing_pattern' panicked at 'attempted to zero-initialize type `alloc::string::String`, which is invalid', src/lib.rs:152:48
stack backtrace:
   0: rust_begin_unwind
             at /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/std/src/panicking.rs:584:5
   1: core::panicking::panic_fmt
             at /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/core/src/panicking.rs:143:14
   2: core::panicking::panic
             at /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/core/src/panicking.rs:48:5
   3: core::mem::zeroed
             at /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/core/src/mem/mod.rs:642:9
   4: <memoization::Memoized<I,O,Func> as core::ops::deref::DerefMut>::deref_mut
             at ./src/lib.rs:152:48
   5: memoization::test::test_testing_pattern
             at ./src/lib.rs:218:9
   6: memoization::test::test_testing_pattern::{{closure}}
             at ./src/lib.rs:208:5
   7: core::ops::function::FnOnce::call_once
             at /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/core/src/ops/function.rs:227:5
   8: core::ops::function::FnOnce::call_once
             at /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/core/src/ops/function.rs:227:5
note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.


failures:
    test::test_memoized_2
    test::test_testing_pattern

test result: FAILED. 1 passed; 2 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s

error: test failed, to rerun pass '--lib'
john@Nagle-LTS:~/projects/rustcode/memoization$ 

@valarauca
Copy link
Owner

Thanks for the reminder @John-Nagle, time got away from me.

Fixed in most recent comment -> 8fe6506

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants