bjoernager/rust
bjoernager/rust
1
Fork 0
Code Activity

Fix undefined behavior in Rc/Arc allocation

Browse source 
Manually calculate allocation layout for `Rc`/`Arc` to avoid undefined behavior
This commit is contained in:
Murarth 2018-10-08 16:52:48 -07:00
parent 423d810986
commit d60290fc63
2 changed files with 14 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

12
src/liballoc/rc.rs
View file

@ -665,15 +665,17 @@ impl Rc<dyn Any> {
impl<T: ?Sized> Rc<T> { impl<T: ?Sized> Rc<T> {
// Allocates an `RcBox<T>` with sufficient space for an unsized value // Allocates an `RcBox<T>` with sufficient space for an unsized value
unsafe fn allocate_for_ptr(ptr: *const T) -> *mut RcBox<T> { unsafe fn allocate_for_ptr(ptr: *const T) -> *mut RcBox<T> {
// Create a fake RcBox to find allocation size and alignment // Calculate layout using the given value.
let fake_ptr = ptr as *mut RcBox<T>; // Previously, layout was calculated on the expression
// `&*(ptr as *const RcBox<T>)`, but this created a misaligned
let layout = Layout::for_value(&*fake_ptr); // reference (see #54908).
let (layout, _) = Layout::new::<RcBox<()>>()
.extend(Layout::for_value(&*ptr)).unwrap();
let mem = Global.alloc(layout) let mem = Global.alloc(layout)
.unwrap_or_else(|_| handle_alloc_error(layout)); .unwrap_or_else(|_| handle_alloc_error(layout));
// Initialize the real RcBox // Initialize the RcBox
let inner = set_data_ptr(ptr as *mut T, mem.as_ptr() as *mut u8) as *mut RcBox<T>; let inner = set_data_ptr(ptr as *mut T, mem.as_ptr() as *mut u8) as *mut RcBox<T>;
ptr::write(&mut (*inner).strong, Cell::new(1)); ptr::write(&mut (*inner).strong, Cell::new(1));

12
src/liballoc/sync.rs
View file

@ -566,15 +566,17 @@ impl<T: ?Sized> Arc<T> {
impl<T: ?Sized> Arc<T> { impl<T: ?Sized> Arc<T> {
// Allocates an `ArcInner<T>` with sufficient space for an unsized value // Allocates an `ArcInner<T>` with sufficient space for an unsized value
unsafe fn allocate_for_ptr(ptr: *const T) -> *mut ArcInner<T> { unsafe fn allocate_for_ptr(ptr: *const T) -> *mut ArcInner<T> {
// Create a fake ArcInner to find allocation size and alignment // Calculate layout using the given value.
let fake_ptr = ptr as *mut ArcInner<T>; // Previously, layout was calculated on the expression
// `&*(ptr as *const ArcInner<T>)`, but this created a misaligned
let layout = Layout::for_value(&*fake_ptr); // reference (see #54908).
let (layout, _) = Layout::new::<ArcInner<()>>()
.extend(Layout::for_value(&*ptr)).unwrap();
let mem = Global.alloc(layout) let mem = Global.alloc(layout)
.unwrap_or_else(|_| handle_alloc_error(layout)); .unwrap_or_else(|_| handle_alloc_error(layout));
// Initialize the real ArcInner // Initialize the ArcInner
let inner = set_data_ptr(ptr as *mut T, mem.as_ptr() as *mut u8) as *mut ArcInner<T>; let inner = set_data_ptr(ptr as *mut T, mem.as_ptr() as *mut u8) as *mut ArcInner<T>;
ptr::write(&mut (*inner).strong, atomic::AtomicUsize::new(1)); ptr::write(&mut (*inner).strong, atomic::AtomicUsize::new(1));