Transmute in headers does not look safe

[reem]

I am not convinced that this is safe: https://github.com/seanmonstar/hyper/blob/master/src/header.rs#L96

I think I could trivially easily cause a segfault with this, by moving the headers out of a Request and sending them across a channel so they live arbitrarily long.

[reem]

On further inspection, I'm actually surprised this works at all... Shouldn't the name defined here (https://github.com/seanmonstar/hyper/blob/master/src/header.rs#L93) be dropped at the end of the function, leaving you with a dangling pointer to it?

[seanmonstar]

Hrm, you're right, that should be a dangling pointer... does it manage to work because HashMap stores the hash u64, instead of the actual &str, and so when checking later, it looks up by u64?

[reem]

It has to store the actual string to resolve collisions, but it will only access the string if there is a collision. Given that most of the examples insert a limited number of headers, it's likely that there just aren't any collisions to resolve in them.Thanks,
Jonathan Reem

On Sat, Sep 6, 2014 at 11:15 PM, Sean McArthur notifications@github.com
wrote:

Hrm, you're right, that should be a dangling pointer... does it manage to work because HashMap stores the hash u64, instead of the actual &str, and so when checking later, it looks up by u64?

Reply to this email directly or view it on GitHub:
#12 (comment)