rust/tests/ui/traits/upcast_soundness_bug.rs
2024-02-16 20:02:50 +00:00

70 lines
1.9 KiB
Rust

#![feature(trait_upcasting)]
//@ known-bug: #120222
//@ check-pass
//! This will segfault at runtime.
pub trait SupSupA {
fn method(&self) {}
}
pub trait SupSupB {}
impl<T> SupSupA for T {}
impl<T> SupSupB for T {}
pub trait Super<T>: SupSupA + SupSupB {}
pub trait Unimplemented {}
pub trait Trait<T1, T2>: Super<T1> + Super<T2> {
fn missing_method(&self)
where
T1: Unimplemented,
{
}
}
impl<S, T> Super<T> for S {}
impl<S, T1, T2> Trait<T1, T2> for S {}
#[inline(never)]
pub fn user1() -> &'static dyn Trait<u8, u8> {
&()
/* VTABLE:
.L__unnamed_2:
.quad core::ptr::drop_in_place<()>
.asciz "\000\000\000\000\000\000\000\000\001\000\000\000\000\000\000"
.quad example::SupSupA::method
.quad .L__unnamed_4 // SupSupB vtable (pointer)
.zero 8 // null pointer for missing_method
*/
}
#[inline(never)]
pub fn user2() -> &'static dyn Trait<u8, u16> {
&()
/* VTABLE:
.L__unnamed_3:
.quad core::ptr::drop_in_place<()>
.asciz "\000\000\000\000\000\000\000\000\001\000\000\000\000\000\000"
.quad example::SupSupA::method
.quad .L__unnamed_4 // SupSupB vtable (pointer)
.quad .L__unnamed_5 // Super<u16> vtable (pointer)
.zero 8 // null pointer for missing_method
*/
}
fn main() {
let p: *const dyn Trait<u8, u8> = &();
let p = p as *const dyn Trait<u8, u16>; // <- this is bad!
let p = p as *const dyn Super<u16>; // <- this upcast accesses improper vtable entry
// accessing from L__unnamed_2 the position for the 'Super<u16> vtable (pointer)',
// thus reading 'null pointer for missing_method'
let p = p as *const dyn SupSupB; // <- this upcast dereferences (null) pointer from that entry
// to read the SupSupB vtable (pointer)
// SEGFAULT
println!("{:?}", p);
}