Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Doc fix #137714

Open
wants to merge 5 commits into
base: master
Choose a base branch
from
Open

Doc fix #137714

wants to merge 5 commits into from

Conversation

DiuDiu777
Copy link
Contributor

@DiuDiu777 DiuDiu777 commented Feb 27, 2025

PR Description​

This PR addresses missing safety documentation for two APIs:

1. alloc::ffi::CStr::from_raw

  • Alias: The pointer ​must not be aliased​ (accessed via other pointers) during the reconstructed CString's lifetime.
  • Owning: Calling this function twice on the same pointer and creating two objects with overlapping lifetimes, introduces two alive owners of the same memory. This may result in a double-free.
  • Dangling: The prior documentation required the pointer to originate from CString::into_raw, but this constraint is incomplete. A validly sourced pointer can also cause undefined behavior (UB) if it becomes dangling. A simple Poc for this situation:
use std::ffi::CString;
use std::os::raw::c_char;

fn create_dangling() -> *mut c_char {
    let local_ptr: *mut c_char = {
        let valid_data = CString::new("valid").unwrap();
        valid_data.into_raw() 
    }; 

    unsafe { 
        let _x = CString::from_raw(local_ptr); 
    } 
    local_ptr
}

fn main() {
    let dangling = create_dangling();
    unsafe {let _y = CString::from_raw(dangling);} // Cause UB!
}

2. alloc::str::from_boxed_utf8_unchecked

  • ValidStr: Bytes must contain a ​valid UTF-8 sequence.

@rustbot
Copy link
Collaborator

rustbot commented Feb 27, 2025

r? @thomcc

rustbot has assigned @thomcc.
They will have a look at your PR within the next two weeks and either review your PR or reassign to another reviewer.

Use r? to explicitly pick a reviewer

@rustbot rustbot added S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. T-libs Relevant to the library team, which will review and decide on the PR/issue. labels Feb 27, 2025
@rust-log-analyzer

This comment has been minimized.

@rust-log-analyzer

This comment has been minimized.

/// obtained by calling [`CString::into_raw`]. Other usage (e.g., trying to take
/// ownership of a string that was allocated by foreign code) is likely to lead
/// to undefined behavior or allocator corruption.
/// obtained by calling [`CString::into_raw`] and this pointer must not be accessed
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

not the pointer, but the memory it points too

///
/// * The provided bytes must contain a valid UTF-8 sequence.
///
/// * The `Box<[u8]>` must have been allocated via the global allocator.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is not a safety requirement. Box<[u8]> is really Box<[u8], Global>, so passing a box with a custom allocator to this function is prevented by type check.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, you are right. I will fix these.

@DiuDiu777 DiuDiu777 requested a review from Sky9x March 3, 2025 12:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. T-libs Relevant to the library team, which will review and decide on the PR/issue.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

5 participants