rust-lang / rust-lang/nomicon

"9. Implementing Vec": Dangling pointer overflow?

Open
#433 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
CSS
Stars
2.3k
Forks
325
PR merge metrics
No merged PRs in 30d

Description

I have an impression that in section 9.11. Final Code any fragment containing
usize) + or
usize + can overflow usize (equal to a dangling pointer), which will result in a panic in debug mode.

See also fragment of interest:

RawVec {
    ptr: NonNull::dangling(),

Details.
The vector's buffer pointer is initialized to a dangling pointer value (so potentially the dangling buffer pointer can be close to overflowing).

For the zero-sized types the buffer is never allocated (the grow() is never called). So the buffer pointer stays dangling.

During the iterator creation the iterator's pointer
RawValIter::end is initialized to the value ((slice.as_ptr() as usize) + slice.len()), where the fragment as usize) + can overflow the usize (equal to a dangling pointer);
also the iterator's pointer RawValIter::start is initialized to the dangling pointer value (possibly close to overflowing), and during subsequent next() the fragment self.start as usize + 1 can overflow the usize.


Would be nice to see in the text of the book (e.g. in 9.11. Final Code)

  • either the confirmation that the overflow can happen (and the reader should handle accordingly),
  • or the explanation why the overflow cannot happen.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with section 9.11, “Final Code,” linked in the issue, and inspect the expressions containing usize) +, usize +, and self.start as usize + 1. Determine whether the zero-sized-type path can overflow around NonNull::dangling(), then update the section to explain the behavior and the handling required; done means the text resolves both alternatives raised in the report.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
documentation
Issue type
Documentation
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.