Skip to content

Guarantee soundness of pointer-to-int transmutes #1752

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
joshlf wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Guarantee soundness of pointer-to-int transmutes #1752

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion src/types/pointer.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,7 +67,7 @@ r[type.pointer.validity]
## Bit validity

r[type.pointer.validity.pointer-fragment]
Despite pointers and references being similar to `usize`s in the machine code emitted on most platforms, the semantics of transmuting a reference or pointer type to a non-pointer type is currently undecided. Thus, it may not be valid to transmute a pointer or reference type, `P`, to a `[u8; size_of::<P>()]`.
A pointer or reference type, `P`, is guaranteed to have all of its bytes initialized. Thus, it is always sound to transmute `p0: P` to `bytes: [u8; size_of::<P>()]`. However, this operation may not preserve provenance, and so transmuting `bytes` back to `p1: P` may result in a pointer or reference without valid provenance. If `P` is a raw pointer type, then it may be the case that dereferencing `p1` is undefined behavior. If `P` is a reference type, then it may be the case that the act of transmuting to `p1` is undefined behavior even if `p1` is never used.

r[type.pointer.validity.raw]
For thin raw pointers (i.e., for `P = *const T` or `P = *mut T` for `T: Sized`), the inverse direction (transmuting from an integer or array of integers to `P`) is always valid. However, the pointer produced via such a transmutation may not be dereferenced (not even if `T` has size zero).
Expand Down