dropbox / dropbox/rust-alloc-no-stdlib

Soundness/documentation issue: CallocBackingStore::new is not safety documented and potentially unsound

Open
#20 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Rust
Stars
180
Forks
21
PR merge metrics
No merged PRs in 30d

Description

The unsafe function CallocBackingStore::new does not have documentation for its safety invariants - and neither does the `define_allocator_memory_pool` macro calling it.
https://github.com/dropbox/rust-alloc-no-stdlib/blob/6032b6a9b20e03737135c55a0270ccffcc1438ef/src/lib.rs#L41

I believe the safety contract should mention that:
- the caller must guarantee that the allocator passed in can be safely called (including the corner-case of having a 0 argument for size), and returns buffers of the appropriate size.
- the correct relationship between `alloc` and `free` is upheld (free must be a valid function to free the memory allocated by `alloc`)
- computing `num_elements * sizeof(T)` must not overflow -- unless that is checked in the body of the function.

Moreover, using the macro with `malloc` is *always* unsound unless `T` is `MaybeUninit<_>`: `new` will end up creating a reference to a slice of uninitialized data, which is UB.
Even using the function with `calloc` might be unsound if `0` is not a valid bit pattern for `T`.
Similarly, when using a custom allocator, the bitpatterns returned by the custom allocator should be valid for `T`.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.