Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use after free, caused by iterator(slice) invalidation not prevented by dip1000/dip25 #25

Closed
ZombineDev opened this Issue Mar 12, 2019 · 1 comment

Comments

Projects
None yet
2 participants
@ZombineDev
Copy link

ZombineDev commented Mar 12, 2019

Test case:

/+ dub.sdl:
dependency "automem" version="~>0.5.1"
dflags "-dip1000" "-dip25"
+/

void main() @safe
{
    import std.stdio : writefln;
    import std.experimental.allocator.mallocator: Mallocator;
    import automem.vector;

    auto vec1 = vector(1, 2, 3);
    int[] slice1 = vec1[];
    vec1.reserve(4096);
    int[] slice2 = vec1[];

    "slice1.ptr: %x, slice2.ptr: %x \nslice1: %s, slice2: %s"
        .writefln(&slice1[0], &slice2[0], slice1, slice2);
}

Sample output:

slice1.ptr: 7fc6d4d21000, slice2.ptr: 7fc6d3800000
slice1: [-724430832, 32710, -820732144], slice2: [1, 2, 3]

As far as I understand, languages with support for substructural type systems usually solve this by allowing either a single mutable reference or zero or more const references.

@atilaneves

This comment has been minimized.

Copy link
Owner

atilaneves commented Mar 13, 2019

This isn't great, but it's convoluted. It shouldn't pass code review, but still, I'll have to think if there's a way to stop this from happening.

@atilaneves atilaneves added the bug label Mar 13, 2019

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.