-
Notifications
You must be signed in to change notification settings - Fork 13.6k
Closed
Labels
I-unsoundIssue: A soundness hole (worst kind of bug), see: https://en.wikipedia.org/wiki/SoundnessIssue: A soundness hole (worst kind of bug), see: https://en.wikipedia.org/wiki/SoundnessP-mediumMedium priorityMedium priorityT-libs-apiRelevant to the library API team, which will review and decide on the PR/issue.Relevant to the library API team, which will review and decide on the PR/issue.
Description
The function allocate_for_ptr
is passed a *const [T]
, which it turns into a &RcBox<[T]>
. Unfortunately, the latter has an alignment of 8 even if T
has smaller alignment. This leads to UB because we have a not-sufficiently-aligned reference.
This got introduced in #42565.
Found by miri (in my branch that verified the validity invariants).
Metadata
Metadata
Assignees
Labels
I-unsoundIssue: A soundness hole (worst kind of bug), see: https://en.wikipedia.org/wiki/SoundnessIssue: A soundness hole (worst kind of bug), see: https://en.wikipedia.org/wiki/SoundnessP-mediumMedium priorityMedium priorityT-libs-apiRelevant to the library API team, which will review and decide on the PR/issue.Relevant to the library API team, which will review and decide on the PR/issue.