-
-
Notifications
You must be signed in to change notification settings - Fork 14.9k
Lifetime bounds of Drop aren't checked properly #148854
Copy link
Copy link
Closed
Labels
A-NLLArea: Non-lexical lifetimes (NLL)Area: Non-lexical lifetimes (NLL)A-borrow-checkerArea: The borrow checkerArea: The borrow checkerA-destructorsArea: Destructors (`Drop`, …)Area: Destructors (`Drop`, …)A-lifetimesArea: Lifetimes / regionsArea: Lifetimes / regionsC-bugCategory: This is a bug.Category: This is a bug.I-unsoundIssue: A soundness hole (worst kind of bug), see: https://en.wikipedia.org/wiki/SoundnessIssue: A soundness hole (worst kind of bug), see: https://en.wikipedia.org/wiki/SoundnessP-highHigh priorityHigh priorityT-compilerRelevant to the compiler team, which will review and decide on the PR/issue.Relevant to the compiler team, which will review and decide on the PR/issue.T-typesRelevant to the types team, which will review and decide on the PR/issue.Relevant to the types team, which will review and decide on the PR/issue.
Metadata
Metadata
Assignees
Labels
A-NLLArea: Non-lexical lifetimes (NLL)Area: Non-lexical lifetimes (NLL)A-borrow-checkerArea: The borrow checkerArea: The borrow checkerA-destructorsArea: Destructors (`Drop`, …)Area: Destructors (`Drop`, …)A-lifetimesArea: Lifetimes / regionsArea: Lifetimes / regionsC-bugCategory: This is a bug.Category: This is a bug.I-unsoundIssue: A soundness hole (worst kind of bug), see: https://en.wikipedia.org/wiki/SoundnessIssue: A soundness hole (worst kind of bug), see: https://en.wikipedia.org/wiki/SoundnessP-highHigh priorityHigh priorityT-compilerRelevant to the compiler team, which will review and decide on the PR/issue.Relevant to the compiler team, which will review and decide on the PR/issue.T-typesRelevant to the types team, which will review and decide on the PR/issue.Relevant to the types team, which will review and decide on the PR/issue.
Type
Fields
Give feedbackNo fields configured for issues without a type.
Projects
Status
Completed
This unsoundness is an exploitation of the weirdness in #115175.
The below code causes use-after-free in safe code. (Prints garbage data in my testing.)
In the function
extend, rust should have prohibited constructing the typeOuter::<T, Inner<T>>, sinceInnerhas aT: 'staticbound, whileTdoesn't have such a lifetime bound inextend. As a result, rust runs the destructor ofOuterwith incorrect lifetimes, which runs theinto_dynfunction ofInnerwith incorrect lifetimes, which then allows unsound lifetime extension.(Trying to do anything with the
Outer::<T, Inner<T>>value other than implicitly running its destructor seems to cause a compile error.)(Edit: Simplified the code to remove one
Dropimpl.)Meta
Reproducible on the playground with stable rust 1.91.1, and with nightly rust
1.93.0-nightly (2025-11-10 29a69716f2c0f19b5f91)