Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Chunk API does not respect align requirement #2

Open
Qwaz opened this issue Aug 26, 2020 · 0 comments
Open

Chunk API does not respect align requirement #2

Qwaz opened this issue Aug 26, 2020 · 0 comments

Comments

@Qwaz
Copy link

Qwaz commented Aug 26, 2020

chunky/src/value.rs

Lines 29 to 41 in ef8533a

impl<V> ::std::ops::Deref for Value<V> {
type Target = V;
fn deref(&self) -> &V {
unsafe { (self.chunk.as_ptr() as *const V).as_ref().unwrap() }
}
}
impl<V> ::std::ops::DerefMut for Value<V> {
fn deref_mut(&mut self) -> &mut V {
unsafe { (self.chunk.as_mut_ptr() as *mut V).as_mut().unwrap() }
}
}

Description

Chunk API does not respect the align requirement of types. Unaligned reference can be created with the API, which is an undefined behavior.

Demonstration

  • Crate: chunky
  • Version: 0.3.7
  • OS: Ubuntu 18.04.5 LTS
  • Rust: rustc 1.47.0-nightly (bf4342114 2020-08-25)
#![forbid(unsafe_code)]

use chunky::{HeapStorage, Ident, Value};
use std::rc::Rc;

#[repr(align(256))]
struct LargeAlign(u8);

impl Drop for LargeAlign {
    fn drop(&mut self) {
        println!("Dropped");
    }
}

fn main() {
    let ident = Ident(String::from("ident"));
    let storage = Rc::new(HeapStorage);
    let value = Value::load_or_default(ident, LargeAlign(0), storage.clone());

    // Value reference does not have a correct alignment
    let v = &*value as *const _ as usize;
    println!("{:x}", v);
    assert!(v % std::mem::align_of::<LargeAlign>() == 0);

    // https://github.com/aeplay/chunky/blob/ef8533aec961eb5f415414dcd81ec4b395bae177/src/value.rs#L43-L49
    // Another bug that is not UB: `LargeAlign::Drop` is not called due to incorrect `drop_in_place()` in `Value::drop()`.
    // "Dropped" should be printed otherwise.
}

Output:

555e921bea80
thread 'main' panicked at 'assertion failed: v % std::mem::align_of::<LargeAlign>() == 0', src/main.rs:42:5
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

Return Code: 101

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant