Unsoundness in dyn-future. #2595
Description
I found an unsound issue here—the pointer validity wasn't checked. However, I can't locate the original repository anymore, so I can only submit it here. It seems like a crate from many years ago. :) cc @xacrimon
use dyn_future::DynFuture;
fn main() {
// Dropping DynFuture triggers UB in Drop (mem::transmute on a dangling ref).
let fut = DynFuture::new(async { 42u8 });
drop(fut);
}
miri outputs:
error: Undefined Behavior: constructing invalid value at .1: encountered a dangling reference (going beyond the bounds of its allocation)
--> /Users/yxz/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/dyn-future-3.0.4/src/lib.rs:162:63
|
162 | ...e { mem::transmute(ptr) };
| ^^^^^^^^^^^^^^^^^^^ Undefined Behavior occurred here
|
= help: this indicates a bug in the program: it performed an invalid operation, and caused Undefined Behavior
= help: see https://doc.rust-lang.org/nightly/reference/behavior-considered-undefined.html for further information
= note: stack backtrace:
0: <dyn_future::DynFuture<u8> as std::ops::Drop>::drop
at /Users/yxz/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/dyn-future-3.0.4/src/lib.rs:162:63: 162:82
1: std::ptr::drop_in_place::<dyn_future::DynFuture<u8>> - shim(Some(dyn_future::DynFuture<u8>))
at /Users/yxz/.rustup/toolchains/nightly-aarch64-apple-darwin/lib/rustlib/src/rust/library/core/src/ptr/mod.rs:805:1: 807:25
2: std::ptr::drop_in_place::<std::pin::Pin<dyn_future::DynFuture<u8>>> - shim(Some(std::pin::Pin<dyn_future::DynFuture<u8>>))
at /Users/yxz/.rustup/toolchains/nightly-aarch64-apple-darwin/lib/rustlib/src/rust/library/core/src/ptr/mod.rs:805:1: 807:25
3: main
at src/main.rs:8:1: 8:2
note: some details are omitted, run with `MIRIFLAGS=-Zmiri-backtrace=full` for a verbose backtrace
error: aborting due to 1 previous error; 2 warnings emitted