Skip to content

Commit 8496292

Browse files
RalfJungRalfJung
committed
properly track why we checked whether a pointer is in-bounds
also simplify the in-bounds checking in Miri's borrow trackers
1 parent 7d58865 commit 8496292

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

44 files changed

+130
-122
lines changed

‎compiler/rustc_const_eval/messages.ftl

+1-1
Original file line numberDiff line numberDiff line change
@@ -282,7 +282,7 @@ const_eval_pointer_out_of_bounds =
282282
*[many] bytes
283283
} starting at offset {$ptr_offset} is out-of-bounds
284284
const_eval_pointer_use_after_free =
285-
pointer to {$allocation} was dereferenced after this allocation got freed
285+
{$bad_pointer_message}: {$alloc_id} has been freed, so this pointer is dangling
286286
const_eval_ptr_as_bytes_1 =
287287
this code performed an operation that depends on the underlying bytes representing a pointer
288288
const_eval_ptr_as_bytes_2 =

‎compiler/rustc_const_eval/src/errors.rs

+5-3
Original file line numberDiff line numberDiff line change
@@ -492,7 +492,7 @@ impl<'a> ReportErrorExt for UndefinedBehaviorInfo<'a> {
492492
InvalidMeta(InvalidMetaKind::SliceTooBig) => const_eval_invalid_meta_slice,
493493
InvalidMeta(InvalidMetaKind::TooBig) => const_eval_invalid_meta,
494494
UnterminatedCString(_) => const_eval_unterminated_c_string,
495-
PointerUseAfterFree(_) => const_eval_pointer_use_after_free,
495+
PointerUseAfterFree(_, _) => const_eval_pointer_use_after_free,
496496
PointerOutOfBounds { ptr_size: Size::ZERO, .. } => const_eval_zst_pointer_out_of_bounds,
497497
PointerOutOfBounds { .. } => const_eval_pointer_out_of_bounds,
498498
DanglingIntPointer(0, _) => const_eval_dangling_null_pointer,
@@ -545,8 +545,10 @@ impl<'a> ReportErrorExt for UndefinedBehaviorInfo<'a> {
545545
UnterminatedCString(ptr) | InvalidFunctionPointer(ptr) | InvalidVTablePointer(ptr) => {
546546
builder.set_arg("pointer", ptr);
547547
}
548-
PointerUseAfterFree(allocation) => {
549-
builder.set_arg("allocation", allocation);
548+
PointerUseAfterFree(alloc_id, msg) => {
549+
builder
550+
.set_arg("alloc_id", alloc_id)
551+
.set_arg("bad_pointer_message", bad_pointer_message(msg, handler));
550552
}
551553
PointerOutOfBounds { alloc_id, alloc_size, ptr_offset, ptr_size, msg } => {
552554
builder

‎compiler/rustc_const_eval/src/interpret/memory.rs

+15-8
Original file line numberDiff line numberDiff line change
@@ -317,7 +317,7 @@ impl<'mir, 'tcx: 'mir, M: Machine<'mir, 'tcx>> InterpCx<'mir, 'tcx, M> {
317317
kind = "static_mem"
318318
)
319319
}
320-
None => err_ub!(PointerUseAfterFree(alloc_id)),
320+
None => err_ub!(PointerUseAfterFree(alloc_id, CheckInAllocMsg::MemoryAccessTest)),
321321
}
322322
.into());
323323
};
@@ -380,7 +380,8 @@ impl<'mir, 'tcx: 'mir, M: Machine<'mir, 'tcx>> InterpCx<'mir, 'tcx, M> {
380380
M::enforce_alignment(self),
381381
CheckInAllocMsg::MemoryAccessTest,
382382
|alloc_id, offset, prov| {
383-
let (size, align) = self.get_live_alloc_size_and_align(alloc_id)?;
383+
let (size, align) = self
384+
.get_live_alloc_size_and_align(alloc_id, CheckInAllocMsg::MemoryAccessTest)?;
384385
Ok((size, align, (alloc_id, offset, prov)))
385386
},
386387
)
@@ -404,7 +405,7 @@ impl<'mir, 'tcx: 'mir, M: Machine<'mir, 'tcx>> InterpCx<'mir, 'tcx, M> {
404405
CheckAlignment::Error,
405406
msg,
406407
|alloc_id, _, _| {
407-
let (size, align) = self.get_live_alloc_size_and_align(alloc_id)?;
408+
let (size, align) = self.get_live_alloc_size_and_align(alloc_id, msg)?;
408409
Ok((size, align, ()))
409410
},
410411
)?;
@@ -414,7 +415,9 @@ impl<'mir, 'tcx: 'mir, M: Machine<'mir, 'tcx>> InterpCx<'mir, 'tcx, M> {
414415
/// Low-level helper function to check if a ptr is in-bounds and potentially return a reference
415416
/// to the allocation it points to. Supports both shared and mutable references, as the actual
416417
/// checking is offloaded to a helper closure. `align` defines whether and which alignment check
417-
/// is done. Returns `None` for size 0, and otherwise `Some` of what `alloc_size` returned.
418+
/// is done.
419+
///
420+
/// If this returns `None`, the size is 0; it can however return `Some` even for size 0.
418421
fn check_and_deref_ptr<T>(
419422
&self,
420423
ptr: Pointer<Option<M::Provenance>>,
@@ -515,7 +518,7 @@ impl<'mir, 'tcx: 'mir, M: Machine<'mir, 'tcx>> InterpCx<'mir, 'tcx, M> {
515518
}
516519
Some(GlobalAlloc::Function(..)) => throw_ub!(DerefFunctionPointer(id)),
517520
Some(GlobalAlloc::VTable(..)) => throw_ub!(DerefVTablePointer(id)),
518-
None => throw_ub!(PointerUseAfterFree(id)),
521+
None => throw_ub!(PointerUseAfterFree(id, CheckInAllocMsg::MemoryAccessTest)),
519522
Some(GlobalAlloc::Static(def_id)) => {
520523
assert!(self.tcx.is_static(def_id));
521524
assert!(!self.tcx.is_thread_local_static(def_id));
@@ -761,11 +764,15 @@ impl<'mir, 'tcx: 'mir, M: Machine<'mir, 'tcx>> InterpCx<'mir, 'tcx, M> {
761764
}
762765
}
763766

764-
/// Obtain the size and alignment of a live allocation.
765-
pub fn get_live_alloc_size_and_align(&self, id: AllocId) -> InterpResult<'tcx, (Size, Align)> {
767+
/// Obtain the size and alignment of a *live* allocation.
768+
fn get_live_alloc_size_and_align(
769+
&self,
770+
id: AllocId,
771+
msg: CheckInAllocMsg,
772+
) -> InterpResult<'tcx, (Size, Align)> {
766773
let (size, align, kind) = self.get_alloc_info(id);
767774
if matches!(kind, AllocKind::Dead) {
768-
throw_ub!(PointerUseAfterFree(id))
775+
throw_ub!(PointerUseAfterFree(id, msg))
769776
}
770777
Ok((size, align))
771778
}

‎compiler/rustc_const_eval/src/interpret/step.rs

+1-2
Original file line numberDiff line numberDiff line change
@@ -224,8 +224,7 @@ impl<'mir, 'tcx: 'mir, M: Machine<'mir, 'tcx>> InterpCx<'mir, 'tcx, M> {
224224

225225
Len(place) => {
226226
let src = self.eval_place(place)?;
227-
let op = self.place_to_op(&src)?;
228-
let len = op.len(self)?;
227+
let len = src.len(self)?;
229228
self.write_scalar(Scalar::from_target_usize(len, self), &dest)?;
230229
}
231230

‎compiler/rustc_middle/src/mir/interpret/error.rs

+2-2
Original file line numberDiff line numberDiff line change
@@ -282,8 +282,8 @@ pub enum UndefinedBehaviorInfo<'a> {
282282
InvalidMeta(InvalidMetaKind),
283283
/// Reading a C string that does not end within its allocation.
284284
UnterminatedCString(Pointer),
285-
/// Dereferencing a dangling pointer after it got freed.
286-
PointerUseAfterFree(AllocId),
285+
/// Using a pointer after it got freed.
286+
PointerUseAfterFree(AllocId, CheckInAllocMsg),
287287
/// Used a pointer outside the bounds it is valid for.
288288
/// (If `ptr_size > 0`, determines the size of the memory range that was expected to be in-bounds.)
289289
PointerOutOfBounds {

‎src/tools/miri/src/borrow_tracker/stacked_borrows/mod.rs

+3-13
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ use rustc_middle::ty::{
1818
layout::{HasParamEnv, LayoutOf},
1919
Ty,
2020
};
21-
use rustc_target::abi::{Abi, Size};
21+
use rustc_target::abi::{Abi, Align, Size};
2222

2323
use crate::borrow_tracker::{
2424
stacked_borrows::diagnostics::{AllocHistory, DiagnosticCx, DiagnosticCxBuilder},
@@ -619,6 +619,8 @@ trait EvalContextPrivExt<'mir: 'ecx, 'tcx: 'mir, 'ecx>: crate::MiriInterpCxExt<'
619619
retag_info: RetagInfo, // diagnostics info about this retag
620620
) -> InterpResult<'tcx, Option<AllocId>> {
621621
let this = self.eval_context_mut();
622+
// Ensure we bail out if the pointer goes out-of-bounds (see miri#1050).
623+
this.check_ptr_access_align(place.ptr, size, Align::ONE, CheckInAllocMsg::InboundsTest)?;
622624

623625
// It is crucial that this gets called on all code paths, to ensure we track tag creation.
624626
let log_creation = |this: &MiriInterpCx<'mir, 'tcx>,
@@ -707,18 +709,6 @@ trait EvalContextPrivExt<'mir: 'ecx, 'tcx: 'mir, 'ecx>: crate::MiriInterpCxExt<'
707709
let (alloc_id, base_offset, orig_tag) = this.ptr_get_alloc_id(place.ptr)?;
708710
log_creation(this, Some((alloc_id, base_offset, orig_tag)))?;
709711

710-
// Ensure we bail out if the pointer goes out-of-bounds (see miri#1050).
711-
let (alloc_size, _) = this.get_live_alloc_size_and_align(alloc_id)?;
712-
if base_offset + size > alloc_size {
713-
throw_ub!(PointerOutOfBounds {
714-
alloc_id,
715-
alloc_size,
716-
ptr_offset: this.target_usize_to_isize(base_offset.bytes()),
717-
ptr_size: size,
718-
msg: CheckInAllocMsg::InboundsTest
719-
});
720-
}
721-
722712
trace!(
723713
"reborrow: reference {:?} derived from {:?} (pointee {}): {:?}, size {}",
724714
new_tag,

‎src/tools/miri/src/borrow_tracker/tree_borrows/mod.rs

+23-39
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
use log::trace;
22

3-
use rustc_target::abi::{Abi, Size};
3+
use rustc_target::abi::{Abi, Align, Size};
44

55
use crate::borrow_tracker::{AccessKind, GlobalStateInner, ProtectorKind, RetagFields};
66
use rustc_middle::{
@@ -182,6 +182,8 @@ trait EvalContextPrivExt<'mir: 'ecx, 'tcx: 'mir, 'ecx>: crate::MiriInterpCxExt<'
182182
new_tag: BorTag,
183183
) -> InterpResult<'tcx, Option<(AllocId, BorTag)>> {
184184
let this = self.eval_context_mut();
185+
// Ensure we bail out if the pointer goes out-of-bounds (see miri#1050).
186+
this.check_ptr_access_align(place.ptr, ptr_size, Align::ONE, CheckInAllocMsg::InboundsTest)?;
185187

186188
// It is crucial that this gets called on all code paths, to ensure we track tag creation.
187189
let log_creation = |this: &MiriInterpCx<'mir, 'tcx>,
@@ -202,51 +204,33 @@ trait EvalContextPrivExt<'mir: 'ecx, 'tcx: 'mir, 'ecx>: crate::MiriInterpCxExt<'
202204
};
203205

204206
trace!("Reborrow of size {:?}", ptr_size);
205-
let (alloc_id, base_offset, parent_prov) = if ptr_size > Size::ZERO {
206-
this.ptr_get_alloc_id(place.ptr)?
207-
} else {
208-
match this.ptr_try_get_alloc_id(place.ptr) {
209-
Ok(data) => data,
210-
Err(_) => {
211-
// This pointer doesn't come with an AllocId, so there's no
212-
// memory to do retagging in.
213-
trace!(
214-
"reborrow of size 0: reference {:?} derived from {:?} (pointee {})",
215-
new_tag,
216-
place.ptr,
217-
place.layout.ty,
218-
);
219-
log_creation(this, None)?;
220-
return Ok(None);
221-
}
207+
let (alloc_id, base_offset, parent_prov) = match this.ptr_try_get_alloc_id(place.ptr) {
208+
Ok(data) => {
209+
// Unlike SB, we *do* a proper retag for size 0 if can identify the allocation.
210+
// After all, the pointer may be lazily initialized outside this initial range.
211+
data
212+
},
213+
Err(_) => {
214+
assert_eq!(ptr_size, Size::ZERO); // we did the deref check above, size has to be 0 here
215+
// This pointer doesn't come with an AllocId, so there's no
216+
// memory to do retagging in.
217+
trace!(
218+
"reborrow of size 0: reference {:?} derived from {:?} (pointee {})",
219+
new_tag,
220+
place.ptr,
221+
place.layout.ty,
222+
);
223+
log_creation(this, None)?;
224+
return Ok(None);
222225
}
223226
};
227+
log_creation(this, Some((alloc_id, base_offset, parent_prov)))?;
228+
224229
let orig_tag = match parent_prov {
225230
ProvenanceExtra::Wildcard => return Ok(None), // TODO: handle wildcard pointers
226231
ProvenanceExtra::Concrete(tag) => tag,
227232
};
228233

229-
// Protection against trying to get a reference to a vtable:
230-
// vtables do not have an alloc_extra so the call to
231-
// `get_alloc_extra` that follows fails.
232-
let (alloc_size, _align, alloc_kind) = this.get_alloc_info(alloc_id);
233-
if ptr_size == Size::ZERO && !matches!(alloc_kind, AllocKind::LiveData) {
234-
return Ok(Some((alloc_id, orig_tag)));
235-
}
236-
237-
log_creation(this, Some((alloc_id, base_offset, parent_prov)))?;
238-
239-
// Ensure we bail out if the pointer goes out-of-bounds (see miri#1050).
240-
if base_offset + ptr_size > alloc_size {
241-
throw_ub!(PointerOutOfBounds {
242-
alloc_id,
243-
alloc_size,
244-
ptr_offset: this.target_usize_to_isize(base_offset.bytes()),
245-
ptr_size,
246-
msg: CheckInAllocMsg::InboundsTest
247-
});
248-
}
249-
250234
trace!(
251235
"reborrow: reference {:?} derived from {:?} (pointee {}): {:?}, size {}",
252236
new_tag,

‎src/tools/miri/tests/fail/alloc/deallocate-twice.rs

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
use std::alloc::{alloc, dealloc, Layout};
22

3-
//@error-in-other-file: dereferenced after this allocation got freed
3+
//@error-in-other-file: has been freed
44

55
fn main() {
66
unsafe {

‎src/tools/miri/tests/fail/alloc/deallocate-twice.stderr

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
1-
error: Undefined Behavior: pointer to ALLOC was dereferenced after this allocation got freed
1+
error: Undefined Behavior: memory access failed: ALLOC has been freed, so this pointer is dangling
22
--> RUSTLIB/alloc/src/alloc.rs:LL:CC
33
|
44
LL | unsafe { __rust_dealloc(ptr, layout.size(), layout.align()) }
5-
| ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ pointer to ALLOC was dereferenced after this allocation got freed
5+
| ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ memory access failed: ALLOC has been freed, so this pointer is dangling
66
|
77
= help: this indicates a bug in the program: it performed an invalid operation, and caused Undefined Behavior
88
= help: see https://doc.rust-lang.org/nightly/reference/behavior-considered-undefined.html for further information

‎src/tools/miri/tests/fail/alloc/reallocate-change-alloc.rs

+1-1
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,6 @@ fn main() {
44
unsafe {
55
let x = alloc(Layout::from_size_align_unchecked(1, 1));
66
let _y = realloc(x, Layout::from_size_align_unchecked(1, 1), 1);
7-
let _z = *x; //~ ERROR: dereferenced after this allocation got freed
7+
let _z = *x; //~ ERROR: has been freed
88
}
99
}

‎src/tools/miri/tests/fail/alloc/reallocate-change-alloc.stderr

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
1-
error: Undefined Behavior: pointer to ALLOC was dereferenced after this allocation got freed
1+
error: Undefined Behavior: dereferencing pointer failed: ALLOC has been freed, so this pointer is dangling
22
--> $DIR/reallocate-change-alloc.rs:LL:CC
33
|
44
LL | let _z = *x;
5-
| ^^ pointer to ALLOC was dereferenced after this allocation got freed
5+
| ^^ dereferencing pointer failed: ALLOC has been freed, so this pointer is dangling
66
|
77
= help: this indicates a bug in the program: it performed an invalid operation, and caused Undefined Behavior
88
= help: see https://doc.rust-lang.org/nightly/reference/behavior-considered-undefined.html for further information

‎src/tools/miri/tests/fail/alloc/reallocate-dangling.rs

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
use std::alloc::{alloc, dealloc, realloc, Layout};
22

3-
//@error-in-other-file: dereferenced after this allocation got freed
3+
//@error-in-other-file: has been freed
44

55
fn main() {
66
unsafe {

‎src/tools/miri/tests/fail/alloc/reallocate-dangling.stderr

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
1-
error: Undefined Behavior: pointer to ALLOC was dereferenced after this allocation got freed
1+
error: Undefined Behavior: memory access failed: ALLOC has been freed, so this pointer is dangling
22
--> RUSTLIB/alloc/src/alloc.rs:LL:CC
33
|
44
LL | unsafe { __rust_realloc(ptr, layout.size(), layout.align(), new_size) }
5-
| ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ pointer to ALLOC was dereferenced after this allocation got freed
5+
| ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ memory access failed: ALLOC has been freed, so this pointer is dangling
66
|
77
= help: this indicates a bug in the program: it performed an invalid operation, and caused Undefined Behavior
88
= help: see https://doc.rust-lang.org/nightly/reference/behavior-considered-undefined.html for further information

‎src/tools/miri/tests/fail/concurrency/thread_local_static_dealloc.rs

+1-1
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,6 @@ unsafe impl Send for SendRaw {}
1111
fn main() {
1212
unsafe {
1313
let dangling_ptr = std::thread::spawn(|| SendRaw(&TLS as *const u8)).join().unwrap();
14-
let _val = *dangling_ptr.0; //~ ERROR: dereferenced after this allocation got freed
14+
let _val = *dangling_ptr.0; //~ ERROR: has been freed
1515
}
1616
}

‎src/tools/miri/tests/fail/concurrency/thread_local_static_dealloc.stderr

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
1-
error: Undefined Behavior: pointer to ALLOC was dereferenced after this allocation got freed
1+
error: Undefined Behavior: dereferencing pointer failed: ALLOC has been freed, so this pointer is dangling
22
--> $DIR/thread_local_static_dealloc.rs:LL:CC
33
|
44
LL | let _val = *dangling_ptr.0;
5-
| ^^^^^^^^^^^^^^^ pointer to ALLOC was dereferenced after this allocation got freed
5+
| ^^^^^^^^^^^^^^^ dereferencing pointer failed: ALLOC has been freed, so this pointer is dangling
66
|
77
= help: this indicates a bug in the program: it performed an invalid operation, and caused Undefined Behavior
88
= help: see https://doc.rust-lang.org/nightly/reference/behavior-considered-undefined.html for further information

‎src/tools/miri/tests/fail/dangling_pointers/dangling_pointer_addr_of.rs

+1-1
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,6 @@ fn main() {
77
let b = Box::new(42);
88
&*b as *const i32
99
};
10-
let x = unsafe { ptr::addr_of!(*p) }; //~ ERROR: dereferenced after this allocation got freed
10+
let x = unsafe { ptr::addr_of!(*p) }; //~ ERROR: has been freed
1111
panic!("this should never print: {:?}", x);
1212
}

‎src/tools/miri/tests/fail/dangling_pointers/dangling_pointer_addr_of.stderr

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
1-
error: Undefined Behavior: pointer to ALLOC was dereferenced after this allocation got freed
1+
error: Undefined Behavior: dereferencing pointer failed: ALLOC has been freed, so this pointer is dangling
22
--> $DIR/dangling_pointer_addr_of.rs:LL:CC
33
|
44
LL | let x = unsafe { ptr::addr_of!(*p) };
5-
| ^^^^^^^^^^^^^^^^^ pointer to ALLOC was dereferenced after this allocation got freed
5+
| ^^^^^^^^^^^^^^^^^ dereferencing pointer failed: ALLOC has been freed, so this pointer is dangling
66
|
77
= help: this indicates a bug in the program: it performed an invalid operation, and caused Undefined Behavior
88
= help: see https://doc.rust-lang.org/nightly/reference/behavior-considered-undefined.html for further information

‎src/tools/miri/tests/fail/dangling_pointers/dangling_pointer_deref.rs

+1-1
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,6 @@ fn main() {
66
let b = Box::new(42);
77
&*b as *const i32
88
};
9-
let x = unsafe { *p }; //~ ERROR: dereferenced after this allocation got freed
9+
let x = unsafe { *p }; //~ ERROR: has been freed
1010
panic!("this should never print: {}", x);
1111
}

‎src/tools/miri/tests/fail/dangling_pointers/dangling_pointer_deref.stderr

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
1-
error: Undefined Behavior: pointer to ALLOC was dereferenced after this allocation got freed
1+
error: Undefined Behavior: dereferencing pointer failed: ALLOC has been freed, so this pointer is dangling
22
--> $DIR/dangling_pointer_deref.rs:LL:CC
33
|
44
LL | let x = unsafe { *p };
5-
| ^^ pointer to ALLOC was dereferenced after this allocation got freed
5+
| ^^ dereferencing pointer failed: ALLOC has been freed, so this pointer is dangling
66
|
77
= help: this indicates a bug in the program: it performed an invalid operation, and caused Undefined Behavior
88
= help: see https://doc.rust-lang.org/nightly/reference/behavior-considered-undefined.html for further information

‎src/tools/miri/tests/fail/dangling_pointers/dangling_pointer_offset.rs

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
// Make sure we find these even with many checks disabled.
2+
//@compile-flags: -Zmiri-disable-alignment-check -Zmiri-disable-stacked-borrows -Zmiri-disable-validation
3+
4+
fn main() {
5+
let p = {
6+
let b = Box::new(42);
7+
&*b as *const i32
8+
};
9+
let x = unsafe { p.offset(42) }; //~ ERROR: /out-of-bounds pointer arithmetic: .* has been freed/
10+
panic!("this should never print: {:?}", x);
11+
}

‎src/tools/miri/tests/fail/dangling_pointers/dangling_pointer_offset.stderr

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
error: Undefined Behavior: out-of-bounds pointer arithmetic: ALLOC has been freed, so this pointer is dangling
2+
--> $DIR/dangling_pointer_offset.rs:LL:CC
3+
|
4+
LL | let x = unsafe { p.offset(42) };
5+
| ^^^^^^^^^^^^ out-of-bounds pointer arithmetic: ALLOC has been freed, so this pointer is dangling
6+
|
7+
= help: this indicates a bug in the program: it performed an invalid operation, and caused Undefined Behavior
8+
= help: see https://doc.rust-lang.org/nightly/reference/behavior-considered-undefined.html for further information
9+
= note: BACKTRACE:
10+
= note: inside `main` at $DIR/dangling_pointer_offset.rs:LL:CC
11+
12+
note: some details are omitted, run with `MIRIFLAGS=-Zmiri-backtrace=full` for a verbose backtrace
13+
14+
error: aborting due to previous error
15+

‎src/tools/miri/tests/fail/dangling_pointers/dangling_pointer_deref_underscore.rs renamed to ‎src/tools/miri/tests/fail/dangling_pointers/dangling_pointer_project_underscore.rs

+1-1
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ fn main() {
77
&*b as *const i32
88
};
99
unsafe {
10-
let _ = *p; //~ ERROR: dereferenced after this allocation got freed
10+
let _ = *p; //~ ERROR: has been freed
1111
}
1212
panic!("this should never print");
1313
}

0 commit comments

Comments
 (0)