From 47014b1bb968be08923a670b1ebfe4deb4256601 Mon Sep 17 00:00:00 2001
From: The 8472 <git@infinite-source.de>
Date: Mon, 16 Jan 2023 21:39:36 +0100
Subject: [PATCH 1/2] Don't do pointer arithmetic on pointers to deallocated
memory
vec::Splice can invalidate the slice::Iter inside vec::Drain.
So we replace them with dangling pointers which, unlike ones to
deallocated memory, are allowed.
---
library/alloc/src/vec/drain.rs | 6 +++---
library/alloc/src/vec/splice.rs | 6 ++++++
2 files changed, 9 insertions(+), 3 deletions(-)
diff --git a/library/alloc/src/vec/drain.rs b/library/alloc/src/vec/drain.rs
index 541f99bcfab..2b1a787cc54 100644
--- a/library/alloc/src/vec/drain.rs
+++ b/library/alloc/src/vec/drain.rs
@@ -223,9 +223,9 @@ impl<T, A: Allocator> Drop for Drain<'_, T, A> {
}
// as_slice() must only be called when iter.len() is > 0 because
- // vec::Splice modifies vec::Drain fields and may grow the vec which would invalidate
- // the iterator's internal pointers. Creating a reference to deallocated memory
- // is invalid even when it is zero-length
+ // it also gets touched by vec::Splice which may turn it into a dangling pointer
+ // which would make it and the vec pointer point to different allocations which would
+ // lead to invalid pointer arithmetic below.
let drop_ptr = iter.as_slice().as_ptr();
unsafe {
diff --git a/library/alloc/src/vec/splice.rs b/library/alloc/src/vec/splice.rs
index bad765c7f51..1861147fe72 100644
--- a/library/alloc/src/vec/splice.rs
+++ b/library/alloc/src/vec/splice.rs
@@ -54,6 +54,12 @@ impl<I: Iterator, A: Allocator> ExactSizeIterator for Splice<'_, I, A> {}
impl<I: Iterator, A: Allocator> Drop for Splice<'_, I, A> {
fn drop(&mut self) {
self.drain.by_ref().for_each(drop);
+ // At this point draining is done and the only remaining tasks are splicing
+ // and moving things into the final place.
+ // Which means we can replace the slice::Iter with pointers that won't point to deallocated
+ // memory, so that Drain::drop is still allowed to call iter.len(), otherwise it would break
+ // the ptr.sub_ptr contract.
+ self.drain.iter = (&[]).iter();
unsafe {
if self.drain.tail_len == 0 {
From 2d54b7ceb2a5c078f019fd2eacf70d59ea37555b Mon Sep 17 00:00:00 2001
From: The 8472 <git@infinite-source.de>
Date: Tue, 17 Jan 2023 20:30:47 +0100
Subject: [PATCH 2/2] add miri regression test
---
src/tools/miri/tests/pass/vec.rs | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/src/tools/miri/tests/pass/vec.rs b/src/tools/miri/tests/pass/vec.rs
index 3a6655e2ba6..30a28bc5803 100644
--- a/src/tools/miri/tests/pass/vec.rs
+++ b/src/tools/miri/tests/pass/vec.rs
@@ -162,6 +162,11 @@ fn reverse() {
assert!(v[0].0 == 49);
}
+fn miri_issue_2759() {
+ let mut input = "1".to_string();
+ input.replace_range(0..0, "0");
+}
+
fn main() {
assert_eq!(vec_reallocate().len(), 5);
@@ -191,4 +196,5 @@ fn main() {
swap();
swap_remove();
reverse();
+ miri_issue_2759();
}