Bounds-check vector::at in refcount

rules/vector/tgt_refcount.rs

@@ -40,7 +40,11 @@ fn f65<T1>(a0: Ptr<T1>) -> Ptr<T1> {
 }
 
 fn f66<T1>(a0: Ptr<T1>, a1: usize) -> Ptr<T1> {
-    a0.offset(a1 as isize)
+    if a1 as usize >= a0.len() {
+        panic!("out of bounds access")
+    } else {
+        a0.offset(a1 as isize)
+    }
 }
 
 fn f68<T1>(a0: Ptr<T1>) -> Ptr<T1> {

tests/ub/out/refcount/vector_at_out_of_range.rs

@@ -0,0 +1,23 @@
+extern crate libcc2rs;
+use libcc2rs::*;
+use std::cell::RefCell;
+use std::collections::BTreeMap;
+use std::io::prelude::*;
+use std::io::{Read, Seek, Write};
+use std::os::fd::AsFd;
+use std::rc::{Rc, Weak};
+pub fn main() {
+    __cpp2rust_init_globals();
+    std::process::exit(main_0());
+}
+fn main_0() -> i32 {
+    let v: Value<Vec<i32>> = Rc::new(RefCell::new(Vec::from([1, 2, 3])));
+    let mut idx: usize = (*v.borrow()).len();
+    let mut p: Ptr<i32> = (if idx as usize >= v.decay().len() {
+        panic!("out of bounds access")
+    } else {
+        v.decay().offset(idx as isize)
+    });
+    return (((p).is_null()) as i32);
+}
+pub fn __cpp2rust_init_globals() {}

tests/ub/out/unsafe/vector_at_out_of_range.rs

@@ -0,0 +1,21 @@
+extern crate libc;
+use libc::*;
+extern crate libcc2rs;
+use libcc2rs::*;
+use std::collections::BTreeMap;
+use std::io::{Read, Seek, Write};
+use std::os::fd::{AsFd, FromRawFd, IntoRawFd};
+use std::rc::Rc;
+pub fn main() {
+    unsafe {
+        __cpp2rust_init_globals();
+        std::process::exit(main_0() as i32);
+    }
+}
+unsafe fn main_0() -> i32 {
+    let mut v: Vec<i32> = Vec::from([1, 2, 3]);
+    let mut idx: usize = v.len();
+    let mut p: *mut i32 = (&mut (v)[idx as usize] as *mut i32);
+    return (((p).is_null()) as i32);
+}
+pub unsafe fn __cpp2rust_init_globals() {}

tests/ub/vector_at_out_of_range.cpp

@@ -0,0 +1,9 @@
+// panic-ub
+#include <vector>
+
+int main() {
+  std::vector<int> v = {1, 2, 3};
+  auto idx = v.size();
+  int *p = &v.at(idx);
+  return p == nullptr;
+}

tests/unit/out/refcount/implicit_autoref.rs

@@ -56,7 +56,15 @@ fn main_0() -> i32 {
     assert!(((index!(p, 1_usize).read()) == 30));
     assert!((b == 40));
     assert!(((vec_elem!((hp), v, 1_usize).read()) == 60));
-    ({ write_through_0((p.decay().offset(0_usize as isize))) });
+    ({
+        write_through_0(
+            (if 0_usize as usize >= p.decay().len() {
+                panic!("out of bounds access")
+            } else {
+                p.decay().offset(0_usize as isize)
+            }),
+        )
+    });
     assert!(((index!(p, 0_usize).read()) == 42));
     return 0;
 }

tests/unit/out/refcount/nested_vector.rs

@@ -17,7 +17,19 @@ fn main_0() -> i32 {
         let a0_clone = v2.clone();
         (*v1.borrow_mut()).push(a0_clone)
     };
-    assert!(((v1.decay().to_last().decay().offset(0_usize as isize).read()) == 1));
+    assert!(
+        ((match (v1.decay().to_last(),) {
+            (__tmp_0,) => {
+                if 0_usize as usize >= __tmp_0.decay().len() {
+                    panic!("out of bounds access")
+                } else {
+                    __tmp_0.decay().offset(0_usize as isize)
+                }
+            }
+        }
+        .read())
+            == 1)
+    );
     return 0;
 }
 pub fn __cpp2rust_init_globals() {}

tests/unit/out/refcount/vector.rs

@@ -282,39 +282,91 @@ fn main_0() -> i32 {
     x0 = 6_f64;
     assert!(((v6.decay().to_last().read()) == 5_f64));
     let mut idx: i32 = 0;
-    assert!(((v6.decay().offset((idx as usize) as isize).read()) == 2_f64));
     assert!(
-        ((v6.decay()
-            .offset((s2).wrapping_sub(1_usize) as isize)
-            .read())
+        ((match ({ (idx as usize) },) {
+            (mut __tmp_11,) => {
+                if __tmp_11 as usize >= v6.decay().len() {
+                    panic!("out of bounds access")
+                } else {
+                    v6.decay().offset(__tmp_11 as isize)
+                }
+            }
+        }
+        .read())
+            == 2_f64)
+    );
+    assert!(
+        ((match ({ (s2).wrapping_sub(1_usize) },) {
+            (mut __tmp_12,) => {
+                if __tmp_12 as usize >= v6.decay().len() {
+                    panic!("out of bounds access")
+                } else {
+                    v6.decay().offset(__tmp_12 as isize)
+                }
+            }
+        }
+        .read())
             == 5_f64)
     );
-    let ref1: Ptr<f64> = v6.decay().offset((s2).wrapping_sub(1_usize) as isize);
+    let ref1: Ptr<f64> = match ({ (s2).wrapping_sub(1_usize) },) {
+        (mut __tmp_13,) => {
+            if __tmp_13 as usize >= v6.decay().len() {
+                panic!("out of bounds access")
+            } else {
+                v6.decay().offset(__tmp_13 as isize)
+            }
+        }
+    };
     {
         ref1.with_mut(|__v| *__v = *__v + 1.5_f64)
     };
     assert!(
-        ((v6.decay()
-            .offset((s2).wrapping_sub(1_usize) as isize)
-            .read())
+        ((match ({ (s2).wrapping_sub(1_usize) },) {
+            (mut __tmp_14,) => {
+                if __tmp_14 as usize >= v6.decay().len() {
+                    panic!("out of bounds access")
+                } else {
+                    v6.decay().offset(__tmp_14 as isize)
+                }
+            }
+        }
+        .read())
             == 6.5_f64)
     );
-    let mut x1: f64 = (v6
-        .decay()
-        .offset((s2).wrapping_sub(1_usize) as isize)
-        .read());
+    let mut x1: f64 = (match ({ (s2).wrapping_sub(1_usize) },) {
+        (mut __tmp_15,) => {
+            if __tmp_15 as usize >= v6.decay().len() {
+                panic!("out of bounds access")
+            } else {
+                v6.decay().offset(__tmp_15 as isize)
+            }
+        }
+    }
+    .read());
     assert!((x1 == 6.5_f64));
     x1 -= 1.5_f64;
     assert!(
-        ((v6.decay()
-            .offset((s2).wrapping_sub(1_usize) as isize)
-            .read())
+        ((match ({ (s2).wrapping_sub(1_usize) },) {
+            (mut __tmp_16,) => {
+                if __tmp_16 as usize >= v6.decay().len() {
+                    panic!("out of bounds access")
+                } else {
+                    v6.decay().offset(__tmp_16 as isize)
+                }
+            }
+        }
+        .read())
             == 6.5_f64)
     );
     assert!(
-        (((s1).wrapping_add(s2))
-            .wrapping_add(((v2.decay().offset(0_usize as isize).read()) as usize))
-            == 103_usize)
+        (((s1).wrapping_add(s2)).wrapping_add(
+            ((if 0_usize as usize >= v2.decay().len() {
+                panic!("out of bounds access")
+            } else {
+                v2.decay().offset(0_usize as isize)
+            }
+            .read()) as usize)
+        ) == 103_usize)
     );
     let a: Value<S> = Rc::new(RefCell::new(S { x: 1 }));
     let pa: Value<Ptr<S>> = Rc::new(RefCell::new((a.as_pointer())));

tests/unit/out/refcount/vector_with_allocator.rs

@@ -184,33 +184,80 @@ fn main_0() -> i32 {
     x0 = 6_f64;
     assert!(((v6.decay().to_last().read()) == 5_f64));
     let mut idx: i32 = 0;
-    assert!(((v6.decay().offset((idx as usize) as isize).read()) == 2_f64));
     assert!(
-        ((v6.decay()
-            .offset((s2).wrapping_sub(1_usize) as isize)
-            .read())
+        ((match ({ (idx as usize) },) {
+            (mut __tmp_2,) => {
+                if __tmp_2 as usize >= v6.decay().len() {
+                    panic!("out of bounds access")
+                } else {
+                    v6.decay().offset(__tmp_2 as isize)
+                }
+            }
+        }
+        .read())
+            == 2_f64)
+    );
+    assert!(
+        ((match ({ (s2).wrapping_sub(1_usize) },) {
+            (mut __tmp_3,) => {
+                if __tmp_3 as usize >= v6.decay().len() {
+                    panic!("out of bounds access")
+                } else {
+                    v6.decay().offset(__tmp_3 as isize)
+                }
+            }
+        }
+        .read())
             == 5_f64)
     );
-    let ref1: Ptr<f64> = v6.decay().offset((s2).wrapping_sub(1_usize) as isize);
+    let ref1: Ptr<f64> = match ({ (s2).wrapping_sub(1_usize) },) {
+        (mut __tmp_4,) => {
+            if __tmp_4 as usize >= v6.decay().len() {
+                panic!("out of bounds access")
+            } else {
+                v6.decay().offset(__tmp_4 as isize)
+            }
+        }
+    };
     {
         ref1.with_mut(|__v| *__v = *__v + 1.5_f64)
     };
     assert!(
-        ((v6.decay()
-            .offset((s2).wrapping_sub(1_usize) as isize)
-            .read())
+        ((match ({ (s2).wrapping_sub(1_usize) },) {
+            (mut __tmp_5,) => {
+                if __tmp_5 as usize >= v6.decay().len() {
+                    panic!("out of bounds access")
+                } else {
+                    v6.decay().offset(__tmp_5 as isize)
+                }
+            }
+        }
+        .read())
             == 6.5_f64)
     );
-    let mut x1: f64 = (v6
-        .decay()
-        .offset((s2).wrapping_sub(1_usize) as isize)
-        .read());
+    let mut x1: f64 = (match ({ (s2).wrapping_sub(1_usize) },) {
+        (mut __tmp_6,) => {
+            if __tmp_6 as usize >= v6.decay().len() {
+                panic!("out of bounds access")
+            } else {
+                v6.decay().offset(__tmp_6 as isize)
+            }
+        }
+    }
+    .read());
     assert!((x1 == 6.5_f64));
     x1 -= 1.5_f64;
     assert!(
-        ((v6.decay()
-            .offset((s2).wrapping_sub(1_usize) as isize)
-            .read())
+        ((match ({ (s2).wrapping_sub(1_usize) },) {
+            (mut __tmp_7,) => {
+                if __tmp_7 as usize >= v6.decay().len() {
+                    panic!("out of bounds access")
+                } else {
+                    v6.decay().offset(__tmp_7 as isize)
+                }
+            }
+        }
+        .read())
             == 6.5_f64)
     );
     let v7: Value<Vec<i32>> = Rc::new(RefCell::new(Vec::new()));
@@ -238,10 +285,10 @@ fn main_0() -> i32 {
     ({ fn_1(v7.as_pointer(), v8.clone()) });
     let src: Value<Box<[u32]>> = Rc::new(RefCell::new(Box::new([1_u32, 2_u32, 3_u32])));
     let mut v9: Vec<u32> = match ({ (src.as_pointer() as Ptr<u32>).offset((3) as isize) },) {
-        (mut __tmp_2,) => {
+        (mut __tmp_8,) => {
             let mut __v = Vec::new();
             let mut __it = (src.as_pointer() as Ptr<u32>);
-            while __it != __tmp_2 {
+            while __it != __tmp_8 {
                 __v.push((__it.iter_deref().read()));
                 __it.iter_inc();
             }
@@ -251,10 +298,10 @@ fn main_0() -> i32 {
     assert!((v9.len() == 3_usize));
     assert!(((v9[0_usize] == 1_u32) && (v9[1_usize] == 2_u32)) && (v9[2_usize] == 3_u32));
     let mut v10: Vec<u64> = match ({ (src.as_pointer() as Ptr<u32>).offset((3) as isize) },) {
-        (mut __tmp_3,) => {
+        (mut __tmp_9,) => {
             let mut __v = Vec::new();
             let mut __it = (src.as_pointer() as Ptr<u32>);
-            while __it != __tmp_3 {
+            while __it != __tmp_9 {
                 __v.push(((__it.iter_deref().read()) as u64));
                 __it.iter_inc();
             }
@@ -264,10 +311,10 @@ fn main_0() -> i32 {
     assert!((v10.len() == 3_usize));
     assert!(((v10[0_usize] == 1_u64) && (v10[1_usize] == 2_u64)) && (v10[2_usize] == 3_u64));
     let mut v11: Vec<i32> = match ({ (src.as_pointer() as Ptr<u32>).offset((3) as isize) },) {
-        (mut __tmp_4,) => {
+        (mut __tmp_10,) => {
             let mut __v = Vec::new();
             let mut __it = (src.as_pointer() as Ptr<u32>);
-            while __it != __tmp_4 {
+            while __it != __tmp_10 {
                 __v.push(((__it.iter_deref().read()) as i32));
                 __it.iter_inc();
             }
@@ -278,10 +325,10 @@ fn main_0() -> i32 {
     assert!(((v11[0_usize] == 1) && (v11[1_usize] == 2)) && (v11[2_usize] == 3));
     let src1: Value<Box<[u32]>> = Rc::new(RefCell::new(Box::new([1_u32, 2_u32, 3_u32])));
     let mut v12: Vec<u32> = match ({ (src1.as_pointer() as Ptr<u32>).to_end() },) {
-        (mut __tmp_5,) => {
+        (mut __tmp_11,) => {
             let mut __v = Vec::new();
             let mut __it = (src1.as_pointer() as Ptr<u32>);
-            while __it != __tmp_5 {
+            while __it != __tmp_11 {
                 __v.push((__it.iter_deref().read()));
                 __it.iter_inc();
             }
@@ -295,10 +342,10 @@ fn main_0() -> i32 {
     let mut start: Ptr<u8> = (buf.as_pointer() as Ptr<u8>);
     let mut len: usize = 5_usize;
     let mut v13: Vec<u8> = match ({ start.offset((len) as isize) },) {
-        (mut __tmp_6,) => {
+        (mut __tmp_12,) => {
             let mut __v = Vec::new();
             let mut __it = (start).clone();
-            while __it != __tmp_6 {
+            while __it != __tmp_12 {
                 __v.push((__it.iter_deref().read()));
                 __it.iter_inc();
             }
@@ -308,9 +355,14 @@ fn main_0() -> i32 {
     assert!((v13.len() == 5_usize));
     assert!(((v13[0_usize] as i32) == 10) && ((v13[4_usize] as i32) == 50));
     assert!(
-        (((s1).wrapping_add(s2))
-            .wrapping_add(((v2.decay().offset(0_usize as isize).read()) as usize))
-            == 103_usize)
+        (((s1).wrapping_add(s2)).wrapping_add(
+            ((if 0_usize as usize >= v2.decay().len() {
+                panic!("out of bounds access")
+            } else {
+                v2.decay().offset(0_usize as isize)
+            }
+            .read()) as usize)
+        ) == 103_usize)
     );
     return 0;
 }