Merge pull request #500 from caelunshun/ub-fix

Fix potential undefined behavior in ArrayQueue initialization
crossbeam-rs · May 17, 2020 · 010ced5 · 010ced5
2 parents 485971e + 2180b82
commit 010ced5
Show file tree

Hide file tree

Showing 2 changed files with 22 additions and 23 deletions.
diff --git a/crossbeam-channel/src/flavors/array.rs b/crossbeam-channel/src/flavors/array.rs
@@ -114,23 +114,23 @@ impl<T> Channel<T> {
         // Tail is initialized to `{ lap: 0, mark: 0, index: 0 }`.
         let tail = 0;
 
-        // Allocate a buffer of `cap` slots.
+        // Allocate a buffer of `cap` slots initialized
+        // with stamps.
         let buffer = {
-            let mut v = Vec::<Slot<T>>::with_capacity(cap);
+            let mut v: Vec<Slot<T>> = (0..cap)
+                .map(|i| {
+                    // Set the stamp to `{ lap: 0, mark: 0, index: i }`.
+                    Slot {
+                        stamp: AtomicUsize::new(i),
+                        msg: UnsafeCell::new(MaybeUninit::uninit()),
+                    }
+                })
+                .collect();
             let ptr = v.as_mut_ptr();
             mem::forget(v);
             ptr
         };
 
-        // Initialize stamps in the slots.
-        for i in 0..cap {
-            unsafe {
-                // Set the stamp to `{ lap: 0, mark: 0, index: i }`.
-                let slot = buffer.add(i);
-                ptr::write(&mut (*slot).stamp, AtomicUsize::new(i));
-            }
-        }
-
         Channel {
             buffer,
             cap,

diff --git a/crossbeam-queue/src/array_queue.rs b/crossbeam-queue/src/array_queue.rs
@@ -13,7 +13,6 @@ use core::cell::UnsafeCell;
 use core::fmt;
 use core::marker::PhantomData;
 use core::mem;
-use core::ptr;
 use core::sync::atomic::{self, AtomicUsize, Ordering};
 
 use crossbeam_utils::{Backoff, CachePadded};
@@ -110,23 +109,23 @@ impl<T> ArrayQueue<T> {
         let head = 0;
         let tail = 0;
 
-        // Allocate a buffer of `cap` slots.
+        // Allocate a buffer of `cap` slots initialized
+        // with stamps.
         let buffer = {
-            let mut v = Vec::<Slot<T>>::with_capacity(cap);
+            let mut v: Vec<Slot<T>> = (0..cap)
+                .map(|i| {
+                    // Set the stamp to `{ lap: 0, index: i }`.
+                    Slot {
+                        stamp: AtomicUsize::new(i),
+                        value: UnsafeCell::new(MaybeUninit::uninit()),
+                    }
+                })
+                .collect();
             let ptr = v.as_mut_ptr();
             mem::forget(v);
             ptr
         };
 
-        // Initialize stamps in the slots.
-        for i in 0..cap {
-            unsafe {
-                // Set the stamp to `{ lap: 0, index: i }`.
-                let slot = buffer.add(i);
-                ptr::write(&mut (*slot).stamp, AtomicUsize::new(i));
-            }
-        }
-
         // One lap is the smallest power of two greater than `cap`.
         let one_lap = (cap + 1).next_power_of_two();