Add a soundness fix for array-init-cursor (#294)

Author: TethysSvensson

Cargo.lock

@@ -40,7 +40,7 @@ tui = "0.19.0"
 vec_map = "0.8.2"
 
 # Our crates
-array-init-cursor = { version = "0.2.0", path = "crates/array-init-cursor" }
+array-init-cursor = { version = "0.2.1", path = "crates/array-init-cursor" }
 planus = { version = "1.1.1", path = "crates/planus", default-features = false }
 planus-buffer-inspection = { version = "1.1.1", path = "crates/planus-buffer-inspection" }
 planus-codegen = { version = "1.1.1", path = "crates/planus-codegen" }

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "array-init-cursor"
-version = "0.2.0"
+version = "0.2.1"
 edition.workspace = true
 license.workspace = true
 repository.workspace = true

crates/array-init-cursor/Cargo.toml

@@ -25,12 +25,7 @@ impl<'a, T, const N: usize> Cursor<'a, T, N> {
     }
 
     fn write_impl(&mut self, value: [T; N]) {
-        *self.slice = unsafe {
-            let ptr = &value as *const [T; N] as *const [MaybeUninit<T>; N];
-            let read_value = core::ptr::read(ptr);
-            core::mem::drop(value);
-            read_value
-        };
+        *self.slice = value.map(|v| MaybeUninit::new(v));
     }
 
     /// Finishes the buffer by writing the remaining values.
@@ -53,8 +48,8 @@ impl<'a, T, const N: usize> Cursor<'a, T, N> {
         r
     }
 
-    unsafe fn into_buf(self) -> &'a mut [MaybeUninit<T>; N] {
-        core::mem::transmute(self)
+    fn into_buf(self) -> &'a mut [MaybeUninit<T>; N] {
+        unsafe { core::mem::transmute(self) }
     }
 
     /// Splits the cursor in two.
@@ -63,7 +58,7 @@ impl<'a, T, const N: usize> Cursor<'a, T, N> {
     /// `cargo check`, since the error is not discovered by `rustc` until it tries to instantiate
     /// the code.
     pub fn split<const L: usize, const R: usize>(self) -> (Cursor<'a, T, L>, Cursor<'a, T, R>) {
-        let buf = unsafe { self.into_buf() };
+        let buf = self.into_buf();
         let (l, r) = crate::util::split_mut::<_, N, L, R>(buf);
         (Cursor { slice: l }, Cursor { slice: r })
     }
@@ -94,3 +89,62 @@ impl<T, const N: usize> Drop for Cursor<'_, T, N> {
         }
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use core::sync::atomic::AtomicU8;
+
+    use super::*;
+
+    #[test]
+    fn test_drop() {
+        struct DropCounter<'a>(&'a AtomicU8);
+        impl core::ops::Drop for DropCounter<'_> {
+            fn drop(&mut self) {
+                self.0.fetch_add(1, core::sync::atomic::Ordering::SeqCst);
+            }
+        }
+
+        let value = AtomicU8::new(0);
+        {
+            let mut data: [MaybeUninit<DropCounter<'_>>; 1] = [MaybeUninit::uninit()];
+            Cursor::new(&mut data).finish([DropCounter(&value)]);
+        }
+        assert_eq!(value.load(core::sync::atomic::Ordering::SeqCst), 0);
+
+        let value = AtomicU8::new(0);
+        {
+            let mut data: [MaybeUninit<DropCounter<'_>>; 2] =
+                [MaybeUninit::uninit(), MaybeUninit::uninit()];
+            Cursor::new(&mut data).finish([DropCounter(&value), DropCounter(&value)]);
+        }
+        assert_eq!(value.load(core::sync::atomic::Ordering::SeqCst), 0);
+
+        let value = AtomicU8::new(0);
+        {
+            let mut data: [MaybeUninit<DropCounter<'_>>; 1] = [MaybeUninit::uninit()];
+            Cursor::new(&mut data).finish([DropCounter(&value)]);
+            let [value] = data;
+            unsafe { value.assume_init() };
+        }
+        assert_eq!(value.load(core::sync::atomic::Ordering::SeqCst), 1);
+
+        let value = AtomicU8::new(0);
+        {
+            let mut data: [MaybeUninit<DropCounter<'_>>; 2] =
+                [MaybeUninit::uninit(), MaybeUninit::uninit()];
+            Cursor::new(&mut data).finish([DropCounter(&value), DropCounter(&value)]);
+            let [value0, value1] = data;
+            unsafe { value0.assume_init() };
+            unsafe { value1.assume_init() };
+        }
+        assert_eq!(value.load(core::sync::atomic::Ordering::SeqCst), 2);
+    }
+
+    #[test]
+    fn test_initalized() {
+        let mut data: [MaybeUninit<u8>; 4] = [MaybeUninit::new(0); 4];
+        Cursor::new(&mut data).write([1, 2]).finish([3, 4]);
+        assert_eq!(data.map(|d| unsafe { d.assume_init() }), [1, 2, 3, 4]);
+    }
+}

crates/array-init-cursor/src/lib.rs

@@ -1,8 +1,7 @@
 use core::num::NonZeroUsize;
 
-use crate::VectorReadUnion;
-
 use super::UnionVector;
+use crate::VectorReadUnion;
 
 fn div_ceil(lhs: usize, rhs: usize) -> usize {
     let d = lhs / rhs;