-
-
Notifications
You must be signed in to change notification settings - Fork 15.4k
Functions, closures, and HRTB-trait-objects can implement traits such that validity of associated types is never checked. #84533
Copy link
Copy link
Open
Labels
A-DSTsArea: Dynamically-sized types (DSTs)Area: Dynamically-sized types (DSTs)A-associated-itemsArea: Associated items (types, constants & functions)Area: Associated items (types, constants & functions)A-closuresArea: Closures (`|…| { … }`)Area: Closures (`|…| { … }`)A-dyn-traitArea: trait objects, vtable layoutArea: trait objects, vtable layoutA-higher-rankedArea: Higher-ranked things (e.g., lifetimes, types, trait bounds aka HRTBs)Area: Higher-ranked things (e.g., lifetimes, types, trait bounds aka HRTBs)A-lifetimesArea: Lifetimes / regionsArea: Lifetimes / regionsA-trait-systemArea: Trait systemArea: Trait systemA-type-systemArea: Type systemArea: Type systemC-bugCategory: This is a bug.Category: This is a bug.I-unsoundIssue: A soundness hole (worst kind of bug), see: https://en.wikipedia.org/wiki/SoundnessIssue: A soundness hole (worst kind of bug), see: https://en.wikipedia.org/wiki/SoundnessP-mediumMedium priorityMedium priorityS-bug-has-testStatus: This bug is tracked inside the repo by a `known-bug` test.Status: This bug is tracked inside the repo by a `known-bug` test.T-compilerRelevant to the compiler team, which will review and decide on the PR/issue.Relevant to the compiler team, which will review and decide on the PR/issue.T-typesRelevant to the types team, which will review and decide on the PR/issue.Relevant to the types team, which will review and decide on the PR/issue.
Description
Metadata
Metadata
Assignees
Labels
A-DSTsArea: Dynamically-sized types (DSTs)Area: Dynamically-sized types (DSTs)A-associated-itemsArea: Associated items (types, constants & functions)Area: Associated items (types, constants & functions)A-closuresArea: Closures (`|…| { … }`)Area: Closures (`|…| { … }`)A-dyn-traitArea: trait objects, vtable layoutArea: trait objects, vtable layoutA-higher-rankedArea: Higher-ranked things (e.g., lifetimes, types, trait bounds aka HRTBs)Area: Higher-ranked things (e.g., lifetimes, types, trait bounds aka HRTBs)A-lifetimesArea: Lifetimes / regionsArea: Lifetimes / regionsA-trait-systemArea: Trait systemArea: Trait systemA-type-systemArea: Type systemArea: Type systemC-bugCategory: This is a bug.Category: This is a bug.I-unsoundIssue: A soundness hole (worst kind of bug), see: https://en.wikipedia.org/wiki/SoundnessIssue: A soundness hole (worst kind of bug), see: https://en.wikipedia.org/wiki/SoundnessP-mediumMedium priorityMedium priorityS-bug-has-testStatus: This bug is tracked inside the repo by a `known-bug` test.Status: This bug is tracked inside the repo by a `known-bug` test.T-compilerRelevant to the compiler team, which will review and decide on the PR/issue.Relevant to the compiler team, which will review and decide on the PR/issue.T-typesRelevant to the types team, which will review and decide on the PR/issue.Relevant to the types team, which will review and decide on the PR/issue.
Type
Fields
No fields configured for issues without a type.
Projects
StatusShow more project fields
new solver everywhere
edit: while this issue has been mostly fixed by #115538, the underlying issue still exists for higher ranked function pointers. It feels highly likely that it can still be exploited, even if the exploit will now be even more involved.
Make sure to also read through the next few comments of mine, where I present some other, significantly different examples of related problems (that’s where HRTBs become relevant, and closures, fn-pointers and trait objects play a role). I also explain the T-lang tag there with a question on changing the meaning of HRTBs that include associated types. Possibly it’s even a sensible thing to split this issue up into two issues.
So if I write a function such as
then
foo’s return type is only valid if'a: 'b. When we call the function this is enforced a the call site, e.g.doesn’t work, with
(playground)
However, if we just instantiate the lifetime parameters, there’s apparently no check being performed at all, i.e.
compiles just fine. (playground).
This seems questionable, the type of
foo::<'b, 'a>implementsFnOncewithOutput = PhantomData<&'b &'a ()>, and it is in fact possible to use this output type to circumvent the borrow checker:(playground)
@rustbot modify labels: A-lifetimes, A-typesystem, T-compiler
and someone please add “I-unsound 💥”.