Open
Description
Adding this test to dictionary.rs exhibits a runtime crash when running on an Apple Silicon mac with cargo test.
#[test]
fn this_is_ub() {
let mut mut_dict: CFMutableDictionary<CFString, CFString> = CFMutableDictionary::new();
let string_key = CFString::from_static_string("Bar");
// make a runtime string that assuredly comes from the heap
let string_val = CFString::new(format!("{:?}", SystemTime::now()).as_str());
mut_dict.add(
&string_key,
&string_val,
);
let dict = mut_dict.to_immutable();
let val = dict.get(string_key);
mut_dict.remove_all();
drop(string_val);
print!("{}", *val);
}
The issue here is that dict.get() returns an ItemRef<'a, CFString> which is tied to the lifetime of dict. However, dict is aliasing the same underlying storage as mut_dict, which means nothing prevents us removing the value and causing UB.
Metadata
Metadata
Assignees
Labels
No labels