Skip to content

Lifetime leak in combination of double link and static #79632

@amarao

Description

@amarao

I tried this code:

static I: i32 = 0;
static R: &'static & i32 = &&I;

fn aux<'a, 'b, T>(_: &'a &'b i32, arg: &'b T) -> &'a T
{
    return arg;
}

fn foo<'a, T>(arg: &'a T) -> &'static T
{
    let f: fn(_, &'a T) -> &'static T = aux;
    return f(R, arg);
}

fn bar() -> &'static i32
{
    let a: i32 = 0;
    return foo(&a);
}

fn main()
{
    let res: &i32 = bar();
    println!("{0}", *res);
}

I expected to see this happen: 0

Instead, this happened: 32765

Meta

Reproducible on nightly and stable (1.48.0)

https://play.rust-lang.org/?version=stable&mode=debug&edition=2018&gist=2a5a193fc1e93f5976eb619fd113b0b1

Based on Russian discussion on Rust safety: https://habr.com/en/company/pvs-studio/blog/530856/?reply_to=22377206#comment_22376840, example was provided by KanuTaH.

Metadata

Metadata

Assignees

No one assigned

    Labels

    C-bugCategory: This is a bug.I-unsoundIssue: A soundness hole (worst kind of bug), see: https://en.wikipedia.org/wiki/Soundness

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions