Unsound in the presence of contravariant or invariant lifetimes

[dtolnay]

Here is an example of Undefined Behavior (use after free) in safe code caused by escher.

use escher::{Escher, Rebindable};
use std::cell::Cell;

#[derive(Rebindable)]
struct Struct<'a>(fn(&'a String));

fn main() {
    static STRING: String = String::new();
    thread_local!(static CELL: Cell<&'static String> = Cell::new(&STRING));
    let escher = Escher::new(|r| async {
        r.capture(Struct(|x| CELL.with(|cell| cell.set(x)))).await;
    });
    let mut string = Ok(".".repeat(3));
    let f = escher.as_ref().0;
    let s = string.as_ref().unwrap();
    f(s);
    string = Err((s.as_ptr(), 100usize, 100usize));
    CELL.with(|cell| println!("{}", cell.get()));
    string.unwrap_err();
}

This should print a variety of interesting characters, such as:

$ cargo run
p*cOVQh@nMVpJծUQhð¢ӮUú-®)VQhú­)V

$ cargo run --release
p¨]UQ°¨]U

To provoke a segfault instead, you can replace s.as_ptr() with 0usize.

[petrosagg]

@dtolnay thank you so much for taking a look! I was planning of posting about this method in the forum soon after improving the explanation.

Regarding the issue, I added a rebind method that rebinds values (whereas the Rebind type alias rebinds types). The generated implementation looks like this:

impl Rebindable for SomeType {
    fn rebind<'short, 'long: 'short>(&'long self) -> &'short Rebind<'short, Self>
    where Self: 'long
    {
        self
    }
}

The above acts as a covariance proof as it only typechecks if SomeType is covariant over its lifetimes and so the compiler will now complain if you attempt to implement this trait on a contravariant or invariant type.

However, the same approach doesn't work for mutable references because a &mut self receiver is invariant over the lifetime of self. I need to think about it more so for now I have removed the implementation of as_mut().

I'm curious of your thoughts on the general approach though, specifically if it is fundamentally unsound or if there is something along these lines.

Thank you again!