- 
                Notifications
    You must be signed in to change notification settings 
- Fork 13.9k
Closed
Labels
A-GATsArea: Generic associated types (GATs)Area: Generic associated types (GATs)C-bugCategory: This is a bug.Category: This is a bug.F-generic_associated_types`#![feature(generic_associated_types)]` a.k.a. GATs`#![feature(generic_associated_types)]` a.k.a. GATsI-unsoundIssue: A soundness hole (worst kind of bug), see: https://en.wikipedia.org/wiki/SoundnessIssue: A soundness hole (worst kind of bug), see: https://en.wikipedia.org/wiki/SoundnessT-compilerRelevant to the compiler team, which will review and decide on the PR/issue.Relevant to the compiler team, which will review and decide on the PR/issue.requires-nightlyThis issue requires a nightly compiler in some way.This issue requires a nightly compiler in some way.
Description
It looks like Generic Associated Types aren't validated on whether the specified type on the impl-side indeed implements the traits as written down in the definition of the associated type.
The following program shows a use-after-free of a String:
#![feature(generic_associated_types)]
trait UnsafeCopy {
    type Item<'a>: Copy;
    
    fn copy<'a>(item: &Self::Item<'a>) -> Self::Item<'a> {
        *item
    }
}
impl <T> UnsafeCopy for T {
    type Item<'a> = T;
}
fn main() {
    let mut s = String::from("Hello world!");
    
    let copy = String::copy(&s);
    
    // Do we indeed point to the samme memory?
    assert!(s.as_ptr() == copy.as_ptr());
    
    // Any use of `copy` is certeinly UB after this
    drop(s);
    
    // UB UB UB UB UB!!
    println!("{}", copy);
}schneiderfelipe
Metadata
Metadata
Assignees
Labels
A-GATsArea: Generic associated types (GATs)Area: Generic associated types (GATs)C-bugCategory: This is a bug.Category: This is a bug.F-generic_associated_types`#![feature(generic_associated_types)]` a.k.a. GATs`#![feature(generic_associated_types)]` a.k.a. GATsI-unsoundIssue: A soundness hole (worst kind of bug), see: https://en.wikipedia.org/wiki/SoundnessIssue: A soundness hole (worst kind of bug), see: https://en.wikipedia.org/wiki/SoundnessT-compilerRelevant to the compiler team, which will review and decide on the PR/issue.Relevant to the compiler team, which will review and decide on the PR/issue.requires-nightlyThis issue requires a nightly compiler in some way.This issue requires a nightly compiler in some way.