argotorg / argotorg/fe

Copying a small string into a larger string container copies data beyond the end of the small string

Open
#814 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Rust
Stars
1.7k
Forks
218
Avg merge
1d 4h
Merged PRs (30d)
8

Description

### What is wrong?

Copying a smaller string into a bigger one (that is, one with a larger maximum size) results in an out-of-bounds memory copy.
Example:
```
let s1: String<3> = "abc"
let foo: Foo = Foo(x: 123)
let s2: String<4> = s1 // 4 bytes of memory, containing "abc" and the value 123

struct Foo {
x: u8
}
```

### How can it be fixed

#777 introduces a `StringSizeIncrease` type adjustment. This could be used in MIR to insert a memcopy that copies the smaller string's number of bytes.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reading the StringSizeIncrease type adjustment introduced in #777 and the MIR handling for assignments between differently sized String values. Reproduce the String<3> to String<4> example and inspect the generated memory copy. Done means the copy is limited to the smaller string's bytes, with a regression test covering the example.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
compilers
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.