rust-lang / rust-lang/reference
UB: Dangling Pointer, ZSTs.
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 1.6k
- Forks
- 607
- PR merge metrics
- PR metrics pending
Description
"16.2. Behavior considered undefined" / "Dangling pointers".
The definition of dangling pointer confuses.
1.
If the size is 0, then the pointer must either point inside of a live allocation (including pointing just after the last byte of the allocation), or it must be directly constructed from a non-zero integer literal.
Which is the right interpretation of the paragraph above?
Interpretation A:
If the size is 0, then in order for the pointer to NOT be dangling the pointer must either point inside of a live allocation (including pointing just after the last byte of the allocation), or it must be directly constructed from a non-zero integer literal.
Interpretation B
{ If the size is 0, then even the dangling pointer must either point inside of a live allocation (including pointing just after the last byte of the allocation), or it must be directly constructed from a non-zero integer literal.
Otherwise, <WHAT?> }
2.
A reference/pointer is "dangling" if it is null or not all of the bytes it points to are part of the same live allocation (so in particular they all have to be part of some allocation).
A. What is the purpose of the fragment "(so in particular they all have to be part of some allocation)"? What will be lost if that fragment is removed?
B. If the pointer points to bytes immediately after the allocation, is that pointer dangling?
3.
Also, (on the same page) in Behavior considered undefined
Evaluating a dereference expression (*expr) on a raw pointer that is dangling or unaligned, even in place expression context (e.g. addr_of!(*expr)).
A. I assume that this paragraph is still applicable to the zero-sized types. In other words, dereferencing a dangling or unaligned zero-sized type raw pointer, is also an undefined behavior. Correct?
B. In the Rustonomicon, 9.11. Final Code, the fragment below (the comments are mine) dereferences the dangling zero-sized type pointer (which is undefined behavior). Correct?
if mem::size_of::<T>() == 0 { // If it is a zero-sized type (ZST)
// . . .
Some(ptr::read(NonNull::<T>::dangling().as_ptr())) // Dereference a dangling ZST pointer (UB).
4.
Note: Uninitialized memory is also implicitly invalid for any type that has a restricted set of valid values. In other words, the only cases in which reading uninitialized memory is permitted are inside unions and in "padding" (the gaps between the fields/elements of a type).
My interpretation: Reading from uninitialized memory, even by using the correctly aligned zero-sized type pointer pointing to a correct allocation, is undefined behavior.
Is this interpretation correct?
Would be nice to see in the book the clarification of those.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the Rust Reference sections on dangling pointers and behavior considered undefined, then compare the cited Rustonomicon “Final Code” example. Resolve the questions about zero-sized types, one-past pointers, dereferencing, and uninitialized memory, and update the relevant documentation so these cases and the intended interpretation are explicit.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- documentation
- Issue type
- Documentation
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 28/100