Bug 1584921

Summary: Rust 1.26 match ergonomics allow improper &mut aliasing
Product: DevTools Reporter: Josh Stone <jistone>
Component: rustAssignee: Josh Stone <jistone>
Status: CLOSED ERRATA QA Contact: Edjunior Barbosa Machado <emachado>
Severity: unspecified Docs Contact: Vladimír Slávik <vslavik>
Priority: unspecified    
Version: rust-toolset-7CC: emachado, jcajka, law, mcermak, tstellar, vslavik
Target Milestone: rc   
Target Release: 2018.3   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: rust-toolset-7-rust-1.26.2-3.el7 Doc Type: No Doc Update
Doc Text:
undefined
Story Points: ---
Clone Of: Environment:
Last Closed: 2018-07-16 14:21:44 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Josh Stone 2018-06-01 00:06:57 UTC
Upstream: https://github.com/rust-lang/rust/issues/51117

The given example code should not be accepted, as "baz" borrows from "bar" -- the latter should be inaccessible until the former goes out of scope.  Since this isn't properly enforced, a use-after-free becomes possible in safe code.

    fn main() {
        let mut foo = Some("foo".to_string());
        let bar = &mut foo;
        match bar {
            Some(baz) => {
                bar.take();
                println!("{:?}", baz); // UAF, segfaults or prints garbage
            },
            None => unreachable!(),
        }
    }

More analysis upstream, and fixed in https://github.com/rust-lang/rust/pull/51235

There will likely be a 1.26.2 release just to address this, so if possible I'd like to simply update to that:  https://github.com/rust-lang/rust/pull/51258

Comment 5 errata-xmlrpc 2018-07-16 14:21:44 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2018:2196