Skip to content

auto trait leakage can be used to leak arbitrary types #13

Open
@lcnr

Description

@lcnr

Using auto trait leakage, it's possible to fully leak opaque types outside of their defining scope

struct RequiresEq<T, U>(T, U);
unsafe impl<T: Send> Send for RequiresEq<T, T> {}

trait GetRhs<T> {
    fn get_rhs(self) -> T;
}
impl<T, U> GetRhs<U> for RequiresEq<T, U> {
    fn get_rhs(self) -> U {
        self.1
    }
}

fn define<T, U: Default>() -> impl GetRhs<U> {
    RequiresEq(1u32, Default::default())
}

fn req_send<T: Send>(x: T) -> T { x }

fn main() {
    let opaque = define::<(), _>();
    // Leak through an opaque type.
    let _hidden_ty: u32 = req_send(opaque).get_rhs();
}
#![feature(type_alias_impl_trait)]
#![allow(unused)]
#![crate_type = "rlib"]

fn require_auto<T: Unpin>(x: T) -> T { x }
struct WaddupGamers<T, U>(Option<T>, U);
impl<T: Leak<Assoc = U>, U> Unpin for WaddupGamers<T, U> {}
trait Leak {
    type Assoc;
}
impl<T> Leak for T {
    type Assoc = T;
}
fn define<T>() -> impl Sized {
    WaddupGamers(None::<T>, || ())
}

type NameMe<T> = impl Sized;
fn leak<T>() -> NameMe<T>
where 
    T: Leak<Assoc = NameMe<T>>,
{
    let opaque = require_auto(define::<T>());
    let closure;
    loop {}
    return closure;
    closure();
}

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions