//! PoC: UB in `<CStr as ToOwned>::clone_into` when the alloc-error
//! handler unwinds.
//!
//! library/alloc/src/ffi/c_str.rs:
//!
//!     fn clone_into(&self, target: &mut CString) {
//!         let mut b = mem::take(&mut target.inner).into_vec();   // (1)
//!         self.to_bytes_with_nul().clone_into(&mut b);            // (2) may alloc
//!         target.inner = b.into_boxed_slice();                    // (3) may alloc
//!     }
//!
//! After (1), `target.inner` is `Box::<[u8]>::default()` — a zero-length
//! slice backed by `NonNull::<u8>::dangling()`. This violates CString's
//! Invariant 1 ("length of at least one"). If (2) or (3) unwinds,
//! `target` is later dropped with that empty `inner`, and
//!
//!     impl Drop for CString {
//!         fn drop(&mut self) {
//!             unsafe { *self.inner.get_unchecked_mut(0) = 0; }
//!         }
//!     }
//!
//! performs an out-of-bounds write through a dangling pointer.
//!
//! ──────────────────────────────────────────────────────────────────────
//! How to run
//! ──────────────────────────────────────────────────────────────────────
//! Put this file at `src/main.rs` in a fresh binary crate.
//!
//! Under Miri (recommended — gives a precise UB diagnostic pointing at
//! `c_str.rs` inside the `Drop` impl):
//!
//!     cargo +nightly miri run
//!
//! Native (segfaults writing to address 0x1):
//!
//!     cargo +nightly run
//!
//! On nightlies that still have the codegen flag, an equivalent trigger
//! that does not require `feature(alloc_error_hook)` is
//! `RUSTFLAGS="-Zoom=panic" cargo +nightly run` with the
//! `set_alloc_error_hook` call removed.

#![feature(alloc_error_hook)]

use std::alloc::{set_alloc_error_hook, GlobalAlloc, Layout, System};
use std::ffi::{CStr, CString};
use std::sync::atomic::{AtomicBool, Ordering};

/// When `true`, the *next* call into the global allocator returns null
/// (simulating OOM) and atomically clears itself, so that the panic
/// machinery's own subsequent allocations succeed normally.
static FAIL_NEXT: AtomicBool = AtomicBool::new(false);

struct OneShotFail;

unsafe impl GlobalAlloc for OneShotFail {
    unsafe fn alloc(&self, l: Layout) -> *mut u8 {
        if FAIL_NEXT.swap(false, Ordering::SeqCst) {
            core::ptr::null_mut()
        } else {
            unsafe { System.alloc(l) }
        }
    }
    unsafe fn dealloc(&self, p: *mut u8, l: Layout) {
        unsafe { System.dealloc(p, l) }
    }
    unsafe fn realloc(&self, p: *mut u8, l: Layout, n: usize) -> *mut u8 {
        if FAIL_NEXT.swap(false, Ordering::SeqCst) {
            core::ptr::null_mut()
        } else {
            unsafe { System.realloc(p, l, n) }
        }
    }
}

#[global_allocator]
static A: OneShotFail = OneShotFail;

fn main() {
    // Make `handle_alloc_error` unwind instead of abort.
    // (Unstable, but panicking from the hook is an explicitly supported
    // path per the oom=panic RFC 2116 work — see rust-lang/rust#43596 and
    // the discussion on rust-lang/rust#147725.)
    set_alloc_error_hook(|l| panic!("oom: {} bytes", l.size()));

    // `dest.inner` is a `Box<[u8]>` of length 2: b"x\0".
    let mut dest = CString::new("x").unwrap();

    // Long enough that `clone_into` must grow the reused buffer.
    let src: &CStr = c"this string is long enough to force the Vec to reallocate";

    // Arm the failure. There are no allocations between here and the
    // `realloc` inside `<[u8]>::clone_into` → `Vec::extend_from_slice`
    // → `RawVec::grow_*`:
    //   * `mem::take` of `Box<[u8]>` produces an empty box (no alloc).
    //   * `into_vec`, `to_bytes_with_nul`, `Vec::clear` do not alloc.
    FAIL_NEXT.store(true, Ordering::SeqCst);

    // (1) `dest.inner` is replaced with an empty box.
    // (2) Growing `b` from cap 2 to ~59 hits our null-returning realloc;
    //     `handle_alloc_error` calls our hook, which panics and unwinds.
    //
    // During unwinding of this frame, `dest` is dropped while
    // `dest.inner.len() == 0`, and `Drop` writes through
    // `get_unchecked_mut(0)` of an empty slice — UB.
    src.clone_into(&mut dest);

    unreachable!();
}

// ──────────────────────────────────────────────────────────────────────
// Variant: surviving CString with broken invariant
// ──────────────────────────────────────────────────────────────────────
//
// The Drop write is not the only consequence. If the OOM panic is caught,
// the `CString` survives with `inner.len() == 0`, and *any* later use is
// UB without a further panic. Replace `main` with the body below to see
// Miri flag `as_bytes()` instead of `Drop`:
//
//     use std::panic::{catch_unwind, AssertUnwindSafe};
//
//     set_alloc_error_hook(|l| panic!("oom: {} bytes", l.size()));
//     let mut dest = CString::new("x").unwrap();
//     let src: &CStr = c"this string is long enough to force the Vec to reallocate";
//
//     FAIL_NEXT.store(true, Ordering::SeqCst);
//     let _ = catch_unwind(AssertUnwindSafe(|| src.clone_into(&mut dest)));
//
//     // CString::as_bytes does
//     //     self.inner.get_unchecked(..self.inner.len() - 1)
//     // i.e. `..usize::MAX` on a dangling pointer.
//     let _boom = dest.as_bytes();