Skip to content

Commit

Permalink
Fix rust-lang#121126: index out of bounds exceeds max value
Browse files Browse the repository at this point in the history
When indexing an array with an index (u32) that exceeds the maximum value allowed by FieldIdx (default: 0xFFFF_FF00), although the compiler would detect the error, it would also cause a panic, which is a bug.
I fixed it by adding a verification before calling the FieldIdx::from_u32(idx) method.
This check ensures that if the idx value is greater than the maximum allowed value, it returns Option::None, similar to how other functions handle errors during the call to the project method of type Value.
  • Loading branch information
c4rrao committed Apr 4, 2024
1 parent 4fd4797 commit 44e66b6
Show file tree
Hide file tree
Showing 3 changed files with 31 additions and 2 deletions.
10 changes: 8 additions & 2 deletions compiler/rustc_mir_transform/src/known_panics_lint.rs
Original file line number Diff line number Diff line change
Expand Up @@ -101,8 +101,14 @@ impl<'tcx> Value<'tcx> {
}
(PlaceElem::Index(idx), Value::Aggregate { fields, .. }) => {
let idx = prop.get_const(idx.into())?.immediate()?;
let idx = prop.ecx.read_target_usize(idx).ok()?;
fields.get(FieldIdx::from_u32(idx.try_into().ok()?)).unwrap_or(&Value::Uninit)
let idx: u32 = prop.ecx.read_target_usize(idx).ok()?.try_into().ok()?;

let max: u32 = FieldIdx::MAX.index().try_into().ok()?;
if idx > max {
return None;
}

fields.get(FieldIdx::from_u32(idx)).unwrap_or(&Value::Uninit)
}
(
PlaceElem::ConstantIndex { offset, min_length: _, from_end: false },
Expand Down
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
// Regression test for #121126. Compiler was panicking when indexing an array
// with an index that is out of bounds and its value is greater than the max
// value allowed for an index.

//@ build-fail

fn main() {
[0][0xFFFF_FF01];
//~^ ERROR this operation will panic at runtime [unconditional_panic]
}

// NOTE: In order for the test to be valid, the index can take on any value
// between FieldIdx::MAX + 1 (= 0xFFF_FF01) and u32::MAX (= 0xFFF_FFFF)
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
error: this operation will panic at runtime
--> $DIR/issue-121126-index-out-of-bounds-exceeds-max-value.rs:8:5
|
LL | [0][0xFFFF_FF01];
| ^^^^^^^^^^^^^^^^ index out of bounds: the length is 1 but the index is 4294967041
|
= note: `#[deny(unconditional_panic)]` on by default

error: aborting due to 1 previous error

0 comments on commit 44e66b6

Please sign in to comment.