Potential footgun in ReadBuf being mem::replaced.

[seanmonstar]

In tokio 0.3, we've adopted the new ReadBuf API for AsyncRead. It's been noticed that there is a potential footgun if an implementor replaces the ReadBuf with a different buffer.

Original issue: rust-lang/rfcs#2930 (comment)

Example

let mut buf = ReadBuf::uninit(&mut some_uninit_buf);
io.poll_read(cx, &mut buf);
let len = buf.filled().len();
return &some_uninit_buf[..len]

One possible solution is to point out that a user should check buf.filled().as_ptr() is still the same.

[carllerche]

I do not believe that this is an 0.3 blocker.

[carllerche]

@seanmonstar you have thoughts on how to proceed here? Will we need any breaking changes to handle this or can we add utility shims on top?

[seanmonstar]

My thoughts aren't much deeper than "well don't do that". The proposed fix feels even grosser (providing some ReadBufHolder<'_> that holds a &mut ReadBuf and is passed by-value to prevent this). 🤷

[carllerche]

Ok, it is a low-level API and involves unsafe. Let's punt on this.