What about: zero-sized dangling accesses/inbounds-offsets? #93
Closed
Description
opened on Feb 23, 2019
Is the following code UB or not?
fn main() {
let mut b = Box::new((((),), 4));
let x: *mut ((),) = &mut b.0;
drop(b);
unsafe {
// getelementptr inbounds with offset 0 of a dangling pointer
let x_inner: *mut () = &mut (*x).0;
// 0-sized access of a dangling pointer
let _val = *x;
}
}
On the one hand, x
is dangling. On the other hand, doing the same thing with let x: *mut ((),) = 1usize as *mut ((),)
would definitely be allowed. Does it make sense to treat dangling pointers as "more dangerous" than integer pointers?
AFAIK the actual accesses do not get translated to LLVM IR, so we are not constrained by LLVM. But we do emit a getelementptr inbounds
, and the rules for that with offset 0 are rather unclear, I would say. @rkruppe do you know anything about this?
Sub-threads / points:
Activity