Skip to content

RPITIT allows the impl to assume more implied bounds than the trait #116060

Closed
@aliemjay

Description

@aliemjay

This is a use-after-free that compiles with 1.74.0-nightly (2023-09-13 8142a31):

#![feature(return_position_impl_trait_in_trait)]

trait Extend {
    fn extend(_: &str) -> (impl Sized + '_, &'static str);
}

impl Extend for () {
    fn extend(s: &str) -> (Option<&'static &'_ ()>, &'static str) {
        (None, s)
    }
}

// This indirection is not necessary for reproduction,
// but it makes this test future-proof against #114936.
fn extend<T: Extend>(s: &str) -> &'static str {
    <T as Extend>::extend(s).1
}

fn main() {
    let use_after_free = extend::<()>(&String::from("temporary"));
    println!("{}", use_after_free);
}

cc @compiler-errors

Metadata

Metadata

Labels

C-bugCategory: This is a bug.F-return_position_impl_trait_in_trait`#![feature(return_position_impl_trait_in_trait)]`I-unsoundIssue: A soundness hole (worst kind of bug), see: https://en.wikipedia.org/wiki/SoundnessT-typesRelevant to the types team, which will review and decide on the PR/issue.requires-nightlyThis issue requires a nightly compiler in some way.

Type

No type

Projects

Status

Done

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions