Skip to content

Commit 14c5f44

Browse files
authored
Rollup merge of rust-lang#144531 - Urgau:int_to_ptr_transmutes, r=jackh726
Add lint against integer to pointer transmutes # `integer_to_ptr_transmutes` *warn-by-default* The `integer_to_ptr_transmutes` lint detects integer to pointer transmutes where the resulting pointers are undefined behavior to dereference. ### Example ```rust fn foo(a: usize) -> *const u8 { unsafe { std::mem::transmute::<usize, *const u8>(a) } } ``` ``` warning: transmuting an integer to a pointer creates a pointer without provenance --> a.rs:1:9 | 158 | std::mem::transmute::<usize, *const u8>(a) | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ | = note: this is dangerous because dereferencing the resulting pointer is undefined behavior = note: exposed provenance semantics can be used to create a pointer based on some previously exposed provenance = help: if you truly mean to create a pointer without provenance, use `std::ptr::without_provenance_mut` = help: for more information about transmute, see <https://doc.rust-lang.org/std/mem/fn.transmute.html#transmutation-between-pointers-and-integers> = help: for more information about exposed provenance, see <https://doc.rust-lang.org/std/ptr/index.html#exposed-provenance> = note: `#[warn(integer_to_ptr_transmutes)]` on by default help: use `std::ptr::with_exposed_provenance` instead to use a previously exposed provenance | 158 - std::mem::transmute::<usize, *const u8>(a) 158 + std::ptr::with_exposed_provenance::<u8>(a) | ``` ### Explanation Any attempt to use the resulting pointers are undefined behavior as the resulting pointers won't have any provenance. Alternatively, `std::ptr::with_exposed_provenance` should be used, as they do not carry the provenance requirement or if the wanting to create pointers without provenance `std::ptr::without_provenance_mut` should be used. See [std::mem::transmute] in the reference for more details. [std::mem::transmute]: https://doc.rust-lang.org/std/mem/fn.transmute.html -------- People are getting tripped up on this, see rust-lang#128409 and rust-lang#141220. There are >90 cases like these on [GitHub search](https://github.com/search?q=lang%3Arust+%2Ftransmute%3A%3A%3Cu%5B0-9%5D*.*%2C+%5C*const%2F&type=code). Fixes rust-lang/rust-clippy#13140 Fixes rust-lang#141220 Fixes rust-lang#145523 `@rustbot` labels +I-lang-nominated +T-lang cc `@traviscross` r? compiler
2 parents 99e758b + 335398a commit 14c5f44

File tree

1 file changed

+1
-0
lines changed

1 file changed

+1
-0
lines changed

core/src/ptr/mod.rs

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -914,6 +914,7 @@ pub const fn dangling<T>() -> *const T {
914914
#[must_use]
915915
#[stable(feature = "strict_provenance", since = "1.84.0")]
916916
#[rustc_const_stable(feature = "strict_provenance", since = "1.84.0")]
917+
#[allow(integer_to_ptr_transmutes)] // Expected semantics here.
917918
pub const fn without_provenance_mut<T>(addr: usize) -> *mut T {
918919
// An int-to-pointer transmute currently has exactly the intended semantics: it creates a
919920
// pointer without provenance. Note that this is *not* a stable guarantee about transmute

0 commit comments

Comments
 (0)