about summary refs log tree commit diff
path: root/library/std/src/sys/random/mod.rs
diff options
context:
space:
mode:
authorStuart Cook <Zalathar@users.noreply.github.com>2025-09-25 20:31:51 +1000
committerGitHub <noreply@github.com>2025-09-25 20:31:51 +1000
commit2acd80cfa928c1371d2c60149b3febe66c9e6637 (patch)
tree9f52346c590501841aa53422d8b4e71e43e18b8c /library/std/src/sys/random/mod.rs
parentbbcbc7818ba27c951f9fd881fd3ec4cd5123b741 (diff)
parent96f385b20aa252629570cadeca16a9e159e6810c (diff)
downloadrust-2acd80cfa928c1371d2c60149b3febe66c9e6637.tar.gz
rust-2acd80cfa928c1371d2c60149b3febe66c9e6637.zip
Rollup merge of #145067 - btj:patch-3, r=tgross35
RawVecInner: add missing `unsafe` to unsafe fns

Some (module-private) functions in `library/alloc/src/raw_vec/mod.rs` are unsafe (i.e. may cause UB when called from safe code) but are not marked `unsafe`. Specifically:
- `RawVecInner::grow_exact` causes UB if called with `len` and `additional` arguments such that `len + additional` is less than the current capacity. Indeed, in that case it calls [Allocator::grow](https://doc.rust-lang.org/std/alloc/trait.Allocator.html#method.grow) with a `new_layout` that is smaller than `old_layout`, which violates a safety precondition.
- The RawVecInner methods for resizing the buffer cause UB if called with an `elem_layout` different from the one used to initially allocate the buffer, because in that case `Allocator::grow` or `Allocator::shrink` are called with an `old_layout` that does not *fit* the allocated block, which violates a safety precondition.
- `RawVecInner::current_memory` might cause UB if called with an `elem_layout` different from the one used to initially allocate the buffer, because the `unchecked_mul` might overflow.
- Furthermore, these methods cause UB if called with an `elem_layout` where the size is not a multiple of the alignment. This is because `Layout::repeat` is used (in `layout_array`) to compute the allocation's layout when allocating, which includes padding to ensure alignment of array elements, but simple multiplication is used (in `current_memory`) to compute the old allocation's layout when resizing or deallocating, which would cause the layout used to resize or deallocate to not *fit* the allocated block, which violates a safety precondition.

I discovered these issues while performing formal verification of `library/alloc/src/raw_vec/mod.rs` per [Challenge 19](https://model-checking.github.io/verify-rust-std/challenges/0019-rawvec.html) of the [AWS Rust Standard Library Verification Contest](https://aws.amazon.com/blogs/opensource/verify-the-safety-of-the-rust-standard-library/).
Diffstat (limited to 'library/std/src/sys/random/mod.rs')
0 files changed, 0 insertions, 0 deletions