Copying a small string into a larger string container copies data beyond the end of the small string
- Dominant language
- Rust
- Stars
- 1.7k
- Forks
- 218
- Avg merge
- 1d 4h
- Merged PRs (30d)
- 8
Description
### What is wrong?
Copying a smaller string into a bigger one (that is, one with a larger maximum size) results in an out-of-bounds memory copy.
Example:
```
let s1: String<3> = "abc"
let foo: Foo = Foo(x: 123)
let s2: String<4> = s1 // 4 bytes of memory, containing "abc" and the value 123
struct Foo {
x: u8
}
```
### How can it be fixed
#777 introduces a `StringSizeIncrease` type adjustment. This could be used in MIR to insert a memcopy that copies the smaller string's number of bytes.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by reading the StringSizeIncrease type adjustment introduced in #777 and the MIR handling for assignments between differently sized String values. Reproduce the String<3> to String<4> example and inspect the generated memory copy. Done means the copy is limited to the smaller string's bytes, with a regression test covering the example.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- compilers
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100