Return nullptr from any_cast on a null pointer and bounds-check vector::at

rules/any/tgt_refcount.rs

@@ -29,10 +29,14 @@ fn f14<T1: 'static>(a0: &mut Option<Rc<dyn std::any::Any>>, init: cpp_type!("std
 }
 
 fn f19<T1: 'static>(a0: Ptr<Option<Rc<dyn std::any::Any>>>) -> Ptr<T1> {
-    a0.with(|__a: &Option<Rc<dyn std::any::Any>>| match __a.clone().map(|__r| __r.downcast::<RefCell<T1>>()) {
-        Some(Ok(__v)) => __v.as_pointer(),
-        _ => Ptr::null(),
-    })
+    if a0.is_null() {
+        Ptr::null()
+    } else {
+        a0.with(|__a: &Option<Rc<dyn std::any::Any>>| match __a.clone().map(|__r| __r.downcast::<RefCell<T1>>()) {
+            Some(Ok(__v)) => __v.as_pointer(),
+            _ => Ptr::null(),
+        })
+    }
 }
 
 fn f27<T1: 'static>(init: cpp_type!("std::decay_t<T1>", T1)) -> Option<Rc<dyn std::any::Any>> {

rules/any/tgt_unsafe.rs

@@ -25,7 +25,7 @@ unsafe fn f14<T1: 'static>(a0: &mut Option<Box<dyn std::any::Any>>, init: cpp_ty
 }
 
 unsafe fn f19<T1: 'static>(a0: *mut Option<Box<dyn std::any::Any>>) -> *mut T1 {
-    match (*a0).as_mut().and_then(|__b| __b.downcast_mut::<T1>()) {
+    match a0.as_mut().and_then(|__a| __a.as_mut()).and_then(|__b| __b.downcast_mut::<T1>()) {
         Some(__v) => __v as *mut T1,
         None => std::ptr::null_mut(),
     }

rules/vector/tgt_refcount.rs

@@ -40,7 +40,11 @@ fn f65<T1>(a0: Ptr<T1>) -> Ptr<T1> {
 }
 
 fn f66<T1>(a0: Ptr<T1>, a1: usize) -> Ptr<T1> {
-    a0.offset(a1 as isize)
+    if a1 as usize >= a0.len() {
+        panic!("out of bounds access")
+    } else {
+        a0.offset(a1 as isize)
+    }
 }
 
 fn f68<T1>(a0: Ptr<T1>) -> Ptr<T1> {

tests/ub/out/refcount/vector_at_out_of_range.rs

@@ -0,0 +1,23 @@
+extern crate libcc2rs;
+use libcc2rs::*;
+use std::cell::RefCell;
+use std::collections::BTreeMap;
+use std::io::prelude::*;
+use std::io::{Read, Seek, Write};
+use std::os::fd::AsFd;
+use std::rc::{Rc, Weak};
+pub fn main() {
+    __cpp2rust_init_globals();
+    std::process::exit(main_0());
+}
+fn main_0() -> i32 {
+    let v: Value<Vec<i32>> = Rc::new(RefCell::new(Vec::from([1, 2, 3])));
+    let mut idx: usize = (*v.borrow()).len();
+    let mut p: Ptr<i32> = (if idx as usize >= v.decay().len() {
+        panic!("out of bounds access")
+    } else {
+        v.decay().offset(idx as isize)
+    });
+    return (((p).is_null()) as i32);
+}
+pub fn __cpp2rust_init_globals() {}

tests/ub/out/unsafe/vector_at_out_of_range.rs

@@ -0,0 +1,21 @@
+extern crate libc;
+use libc::*;
+extern crate libcc2rs;
+use libcc2rs::*;
+use std::collections::BTreeMap;
+use std::io::{Read, Seek, Write};
+use std::os::fd::{AsFd, FromRawFd, IntoRawFd};
+use std::rc::Rc;
+pub fn main() {
+    unsafe {
+        __cpp2rust_init_globals();
+        std::process::exit(main_0() as i32);
+    }
+}
+unsafe fn main_0() -> i32 {
+    let mut v: Vec<i32> = Vec::from([1, 2, 3]);
+    let mut idx: usize = v.len();
+    let mut p: *mut i32 = (&mut (v)[idx as usize] as *mut i32);
+    return (((p).is_null()) as i32);
+}
+pub unsafe fn __cpp2rust_init_globals() {}

tests/ub/vector_at_out_of_range.cpp

@@ -0,0 +1,9 @@
+// panic-ub
+#include <vector>
+
+int main() {
+  std::vector<int> v = {1, 2, 3};
+  auto idx = v.size();
+  int *p = &v.at(idx);
+  return p == nullptr;
+}

tests/unit/any.cpp

@@ -24,5 +24,7 @@ int main() {
   b.reset();
   assert(!b.has_value());
   assert(std::any_cast<int>(&b) == nullptr);
+  std::any *n = nullptr;
+  assert(std::any_cast<int>(n) == nullptr);
   return 0;
 }

tests/unit/out/refcount/any.rs

@@ -28,23 +28,38 @@ fn main_0() -> i32 {
         RefCell::new(Point::new({ 3 }, { 4 })),
     ))));
     assert!(({ (*a.borrow()).is_some() }));
-    let mut p: Ptr<Point> = (a.as_pointer()).with(|__a: &Option<Rc<dyn std::any::Any>>| match __a
-        .clone()
-        .map(|__r| __r.downcast::<RefCell<Point>>())
-    {
-        Some(Ok(__v)) => __v.as_pointer(),
-        _ => Ptr::null(),
-    });
+    let mut p: Ptr<Point> = match ({ (a.as_pointer()) },) {
+        (mut __tmp_0,) => {
+            if __tmp_0.is_null() {
+                Ptr::null()
+            } else {
+                __tmp_0.with(|__a: &Option<Rc<dyn std::any::Any>>| {
+                    match __a.clone().map(|__r| __r.downcast::<RefCell<Point>>()) {
+                        Some(Ok(__v)) => __v.as_pointer(),
+                        _ => Ptr::null(),
+                    }
+                })
+            }
+        }
+    };
     assert!(!((p).is_null()));
     assert!((p.with(|__s| __s.x) == 3));
     assert!((p.with(|__s| __s.y) == 4));
     assert!(
-        ((a.as_pointer()).with(|__a: &Option<Rc<dyn std::any::Any>>| {
-            match __a.clone().map(|__r| __r.downcast::<RefCell<i32>>()) {
-                Some(Ok(__v)) => __v.as_pointer(),
-                _ => Ptr::null(),
+        (match ({ (a.as_pointer()) },) {
+            (mut __tmp_1,) => {
+                if __tmp_1.is_null() {
+                    Ptr::null()
+                } else {
+                    __tmp_1.with(|__a: &Option<Rc<dyn std::any::Any>>| {
+                        match __a.clone().map(|__r| __r.downcast::<RefCell<i32>>()) {
+                            Some(Ok(__v)) => __v.as_pointer(),
+                            _ => Ptr::null(),
+                        }
+                    })
+                }
             }
-        }))
+        })
         .is_null()
     );
     let q: Ptr<Point> = {
@@ -55,38 +70,74 @@ fn main_0() -> i32 {
     };
     assert!((q.with(|__s| __s.x) == 5));
     assert!(
-        ((a.as_pointer())
-            .with(|__a: &Option<Rc<dyn std::any::Any>>| {
-                match __a.clone().map(|__r| __r.downcast::<RefCell<Point>>()) {
-                    Some(Ok(__v)) => __v.as_pointer(),
-                    _ => Ptr::null(),
+        (match ({ (a.as_pointer()) },) {
+            (mut __tmp_2,) => {
+                if __tmp_2.is_null() {
+                    Ptr::null()
+                } else {
+                    __tmp_2.with(|__a: &Option<Rc<dyn std::any::Any>>| {
+                        match __a.clone().map(|__r| __r.downcast::<RefCell<Point>>()) {
+                            Some(Ok(__v)) => __v.as_pointer(),
+                            _ => Ptr::null(),
+                        }
+                    })
                 }
-            })
-            .with(|__s| __s.y)
+            }
+        }
+        .with(|__s| __s.y)
             == 6)
     );
     let b: Value<Option<Rc<dyn std::any::Any>>> =
         Rc::new(RefCell::new(Some(Rc::new(RefCell::new(7)))));
     assert!(
-        (((b.as_pointer())
-            .with(|__a: &Option<Rc<dyn std::any::Any>>| {
-                match __a.clone().map(|__r| __r.downcast::<RefCell<i32>>()) {
-                    Some(Ok(__v)) => __v.as_pointer(),
-                    _ => Ptr::null(),
+        ((match ({ (b.as_pointer()) },) {
+            (mut __tmp_3,) => {
+                if __tmp_3.is_null() {
+                    Ptr::null()
+                } else {
+                    __tmp_3.with(|__a: &Option<Rc<dyn std::any::Any>>| {
+                        match __a.clone().map(|__r| __r.downcast::<RefCell<i32>>()) {
+                            Some(Ok(__v)) => __v.as_pointer(),
+                            _ => Ptr::null(),
+                        }
+                    })
                 }
-            })
-            .read())
+            }
+        }
+        .read())
             == 7)
     );
     (*b.borrow_mut()) = None;
     assert!(({ !((*b.borrow()).is_some()) }));
     assert!(
-        ((b.as_pointer()).with(|__a: &Option<Rc<dyn std::any::Any>>| {
-            match __a.clone().map(|__r| __r.downcast::<RefCell<i32>>()) {
-                Some(Ok(__v)) => __v.as_pointer(),
-                _ => Ptr::null(),
+        (match ({ (b.as_pointer()) },) {
+            (mut __tmp_4,) => {
+                if __tmp_4.is_null() {
+                    Ptr::null()
+                } else {
+                    __tmp_4.with(|__a: &Option<Rc<dyn std::any::Any>>| {
+                        match __a.clone().map(|__r| __r.downcast::<RefCell<i32>>()) {
+                            Some(Ok(__v)) => __v.as_pointer(),
+                            _ => Ptr::null(),
+                        }
+                    })
+                }
             }
-        }))
+        })
+        .is_null()
+    );
+    let mut n: Ptr<Option<Rc<dyn std::any::Any>>> = Ptr::<Option<Rc<dyn std::any::Any>>>::null();
+    assert!(
+        (if n.is_null() {
+            Ptr::null()
+        } else {
+            n.with(|__a: &Option<Rc<dyn std::any::Any>>| {
+                match __a.clone().map(|__r| __r.downcast::<RefCell<i32>>()) {
+                    Some(Ok(__v)) => __v.as_pointer(),
+                    _ => Ptr::null(),
+                }
+            })
+        })
         .is_null()
     );
     return 0;

tests/unit/out/refcount/implicit_autoref.rs

@@ -56,7 +56,15 @@ fn main_0() -> i32 {
     assert!(((index!(p, 1_usize).read()) == 30));
     assert!((b == 40));
     assert!(((vec_elem!((hp), v, 1_usize).read()) == 60));
-    ({ write_through_0((p.decay().offset(0_usize as isize))) });
+    ({
+        write_through_0(
+            (if 0_usize as usize >= p.decay().len() {
+                panic!("out of bounds access")
+            } else {
+                p.decay().offset(0_usize as isize)
+            }),
+        )
+    });
     assert!(((index!(p, 0_usize).read()) == 42));
     return 0;
 }

tests/unit/out/refcount/nested_vector.rs

@@ -17,7 +17,19 @@ fn main_0() -> i32 {
         let a0_clone = v2.clone();
         (*v1.borrow_mut()).push(a0_clone)
     };
-    assert!(((v1.decay().to_last().decay().offset(0_usize as isize).read()) == 1));
+    assert!(
+        ((match (v1.decay().to_last(),) {
+            (__tmp_0,) => {
+                if 0_usize as usize >= __tmp_0.decay().len() {
+                    panic!("out of bounds access")
+                } else {
+                    __tmp_0.decay().offset(0_usize as isize)
+                }
+            }
+        }
+        .read())
+            == 1)
+    );
     return 0;
 }
 pub fn __cpp2rust_init_globals() {}

tests/unit/out/refcount/vector.rs

@@ -282,39 +282,91 @@ fn main_0() -> i32 {
     x0 = 6_f64;
     assert!(((v6.decay().to_last().read()) == 5_f64));
     let mut idx: i32 = 0;
-    assert!(((v6.decay().offset((idx as usize) as isize).read()) == 2_f64));
     assert!(
-        ((v6.decay()
-            .offset((s2).wrapping_sub(1_usize) as isize)
-            .read())
+        ((match ({ (idx as usize) },) {
+            (mut __tmp_11,) => {
+                if __tmp_11 as usize >= v6.decay().len() {
+                    panic!("out of bounds access")
+                } else {
+                    v6.decay().offset(__tmp_11 as isize)
+                }
+            }
+        }
+        .read())
+            == 2_f64)
+    );
+    assert!(
+        ((match ({ (s2).wrapping_sub(1_usize) },) {
+            (mut __tmp_12,) => {
+                if __tmp_12 as usize >= v6.decay().len() {
+                    panic!("out of bounds access")
+                } else {
+                    v6.decay().offset(__tmp_12 as isize)
+                }
+            }
+        }
+        .read())
             == 5_f64)
     );
-    let ref1: Ptr<f64> = v6.decay().offset((s2).wrapping_sub(1_usize) as isize);
+    let ref1: Ptr<f64> = match ({ (s2).wrapping_sub(1_usize) },) {
+        (mut __tmp_13,) => {
+            if __tmp_13 as usize >= v6.decay().len() {
+                panic!("out of bounds access")
+            } else {
+                v6.decay().offset(__tmp_13 as isize)
+            }
+        }
+    };
     {
         ref1.with_mut(|__v| *__v = *__v + 1.5_f64)
     };
     assert!(
-        ((v6.decay()
-            .offset((s2).wrapping_sub(1_usize) as isize)
-            .read())
+        ((match ({ (s2).wrapping_sub(1_usize) },) {
+            (mut __tmp_14,) => {
+                if __tmp_14 as usize >= v6.decay().len() {
+                    panic!("out of bounds access")
+                } else {
+                    v6.decay().offset(__tmp_14 as isize)
+                }
+            }
+        }
+        .read())
             == 6.5_f64)
     );
-    let mut x1: f64 = (v6
-        .decay()
-        .offset((s2).wrapping_sub(1_usize) as isize)
-        .read());
+    let mut x1: f64 = (match ({ (s2).wrapping_sub(1_usize) },) {
+        (mut __tmp_15,) => {
+            if __tmp_15 as usize >= v6.decay().len() {
+                panic!("out of bounds access")
+            } else {
+                v6.decay().offset(__tmp_15 as isize)
+            }
+        }
+    }
+    .read());
     assert!((x1 == 6.5_f64));
     x1 -= 1.5_f64;
     assert!(
-        ((v6.decay()
-            .offset((s2).wrapping_sub(1_usize) as isize)
-            .read())
+        ((match ({ (s2).wrapping_sub(1_usize) },) {
+            (mut __tmp_16,) => {
+                if __tmp_16 as usize >= v6.decay().len() {
+                    panic!("out of bounds access")
+                } else {
+                    v6.decay().offset(__tmp_16 as isize)
+                }
+            }
+        }
+        .read())
             == 6.5_f64)
     );
     assert!(
-        (((s1).wrapping_add(s2))
-            .wrapping_add(((v2.decay().offset(0_usize as isize).read()) as usize))
-            == 103_usize)
+        (((s1).wrapping_add(s2)).wrapping_add(
+            ((if 0_usize as usize >= v2.decay().len() {
+                panic!("out of bounds access")
+            } else {
+                v2.decay().offset(0_usize as isize)
+            }
+            .read()) as usize)
+        ) == 103_usize)
     );
     let a: Value<S> = Rc::new(RefCell::new(S { x: 1 }));
     let pa: Value<Ptr<S>> = Rc::new(RefCell::new((a.as_pointer())));