chitoyuu/lifelink

Erase covariant lifetime parameters from anything, with generic associated types.

lifelink's Issues

Forget unsoundness

When Deathtouch is forgotten (e.g. via mem::forget), this ends the borrow of the original variable without running the drop implementation of Deathtouch. Thus, the lifelink remains usable and this can lead to UB such as aliasing with &mut or use after free:

fn main() {
    use lifelink::{Lifelink, RefCtor};

    let mut value = Box::new(4u8);

    let (mut lifelink, deathtouch) = Lifelink::<RefCtor<u8>>::new(&*value);
    let guard = lifelink.get().unwrap();
    core::mem::forget(deathtouch);

    println!("{}", *guard);
    *value = 8; // guard aliases with mutable access
    println!("{}", *guard);
    drop(value);
    println!("{}", *guard); // use after free
}

Since forgetting is safe, the current API is unsound.

Potential Solutions

• Have LifeLink::new accept a closure that is provided the lifelink. Then use the scopeguard crate (or the same techniques as scopeguard) to ensure that the code to reclaim the borrow from the lifelink always runs when that closure completes or panics.
• Use a macro instead of LifeLink::new, that macro will place the Deathtouch in a local that is automatically dropped at the end of the current scope, with the local defined inside the macro, user code will not be able to forget it since it can't be named outside of the macro (e.g. similar to scopeguard::defer!).