|
35 | 35 | that type must satisfy [VALID]_. |
36 | 36 | Reading a union field performs a *typed read*, |
37 | 37 | which asserts that the bytes are valid for the target type. |
38 | | - Violating this invariant is undefined behavior. |
39 | 38 |
|
40 | 39 | Examples of validity requirements for common types: |
41 | 40 |
|
|
46 | 45 | * **Floating point**: All bit patterns are valid for the ``f32`` or ``f64``.type |
47 | 46 | * **Integers**: All bit patterns are valid for integer types. |
48 | 47 |
|
49 | | - Consequences of reading invalid values include: |
50 | | -
|
51 | | - * Immediate undefined behavior, even if the value is not used |
52 | | - * Miscompilation due to compiler assumptions about valid values |
53 | | - * Security vulnerabilities from unexpected program behavior |
54 | | - * Non-deterministic behavior that varies across optimization levels or platforms |
| 48 | + Reading an invalid value is undefined behavior. |
55 | 49 |
|
56 | 50 | .. non_compliant_example:: |
57 | 51 | :id: non_compl_ex_UnionBool |
58 | 52 | :status: draft |
59 | 53 |
|
60 | | - This example reads a boolean from a union field containing an invalid bit pattern. |
61 | | - The value ``3`` is not a valid boolean (only ``0`` and ``1`` are valid). |
| 54 | + This noncompliant example reads a Boolean from a union field containing an invalid bit pattern. |
| 55 | + The value ``3`` is not a valid Boolean (only ``0`` and ``1`` are valid). |
62 | 56 |
|
63 | 57 | .. code-block:: rust |
64 | 58 |
|
|
70 | 64 | fn main() { |
71 | 65 | let u = IntOrBool { i: 3 }; |
72 | 66 | |
73 | | - // Noncompliant: reading bool field with invalid value (3) |
74 | | - let invalid_bool = unsafe { u.b }; // UB: 3 is not a valid bool |
| 67 | + // Undefined behavior reading an invalid value from a union field of type 'bool' |
| 68 | + unsafe { u.b }; // Noncompliant |
75 | 69 | } |
76 | 70 |
|
77 | 71 | .. non_compliant_example:: |
78 | 72 | :id: non_compl_ex_UnionChar |
79 | 73 | :status: draft |
80 | 74 |
|
81 | | - This example reads a ``char`` from a union containing an invalid Unicode value. |
| 75 | + This noncompliant example reads a ``char`` from a ``union`` containing an invalid Unicode value. |
82 | 76 |
|
83 | 77 | .. code-block:: rust |
84 | 78 |
|
|
88 | 82 | } |
89 | 83 |
|
90 | 84 | fn main() { |
91 | | - // 0xD800 is a surrogate, not a valid Unicode scalar value |
| 85 | + // 0xD800 is a surrogate and not a valid Unicode scalar value |
92 | 86 | let u = IntOrChar { i: 0xD800 }; |
93 | 87 | |
94 | | - // Non-compliant: reading char field with invalid Unicode value |
95 | | - let invalid_char = unsafe { u.c }; // UB: surrogates are not valid chars |
| 88 | + // Noncompliant: reading an invalid Unicode value from a union field of type 'char' |
| 89 | + unsafe { u.c }; // Noncompliant |
96 | 90 | } |
97 | 91 |
|
98 | 92 | .. non_compliant_example:: |
99 | 93 | :id: non_compl_ex_UnionEnum |
100 | 94 | :status: draft |
101 | 95 |
|
102 | | - This example reads an enum from a ``union`` containing an invalid discriminant. |
| 96 | + This noncompliant example reads an invalid discriminant from a ``union`` field of 'Color' enumeration type. |
103 | 97 |
|
104 | 98 | .. code-block:: rust |
105 | 99 |
|
|
119 | 113 | fn main() { |
120 | 114 | let u = IntOrColor { i: 42 }; |
121 | 115 | |
122 | | - // Noncompliant: 42 is not a valid Color discriminant |
123 | | - let invalid_color = unsafe { u.c }; // UB: no Color variant for 42 |
| 116 | + // Undefined behavior reading an invalid discriminant from the 'Color' enumeration type |
| 117 | + unsafe { u.c }; // Noncompliant |
124 | 118 | } |
125 | 119 |
|
126 | 120 | .. non_compliant_example:: |
127 | 121 | :id: non_compl_ex_UnionRef |
128 | 122 | :status: draft |
129 | 123 |
|
130 | | - This example reads a reference from a ``union`` containing a null or misaligned pointer. |
| 124 | + This noncompliant example reads a reference from a ``union`` containing a null or misaligned pointer. |
131 | 125 |
|
132 | 126 | .. code-block:: rust |
133 | 127 |
|
|
147 | 141 | :id: compl_ex_UnionTrackField |
148 | 142 | :status: draft |
149 | 143 |
|
150 | | - Track the active field explicitly to ensure valid reads. |
| 144 | + This compliant example tracks the active field explicitly to ensure valid reads. |
151 | 145 |
|
152 | 146 | .. code-block:: rust |
153 | 147 |
|
|
202 | 196 | :id: compl_ex_UnionSameField |
203 | 197 | :status: draft |
204 | 198 |
|
205 | | - Read from the same field that was written. |
| 199 | + This compliant solution read from the same field that was written. |
206 | 200 |
|
207 | 201 | .. code-block:: rust |
208 | 202 |
|
|
223 | 217 | :id: compl_ex_UnionValidReinterpret |
224 | 218 | :status: draft |
225 | 219 |
|
226 | | - Reinterpret between types where all bit patterns are valid. |
| 220 | + This compliant example reinterprets the value as a different types where all bit patterns are valid. |
227 | 221 |
|
228 | 222 | .. code-block:: rust |
229 | 223 |
|
|
250 | 244 | :id: compl_ex_UnionValidateBool |
251 | 245 | :status: draft |
252 | 246 |
|
253 | | - Validate bytes before reading as a constrained type. |
| 247 | + This compliant solution validates bytes before reading as a constrained type. |
254 | 248 |
|
255 | 249 | .. code-block:: rust |
256 | 250 |
|
|
286 | 280 |
|
287 | 281 | .. list-table:: |
288 | 282 | :header-rows: 0 |
289 | | - :widths: 5 85 |
| 283 | + :widths: 5 60 |
290 | 284 |
|
291 | 285 | * - .. [UNION] |
292 | 286 | - The Rust Project Developers. "Rust Reference: Unions." *The Rust Reference*, n.d. https://doc.rust-lang.org/reference/items/unions.html. |
|
0 commit comments