Skip to content

Commit 967f172

Browse files
committed
Auto merge of #9635 - smoelius:fix-9386-bug, r=Jarcho
Fix bug introduced by #9386 #9386 introduced a potential out-of-bounds array access. Specifically, a location returned by `local_assignments` could have [`location.statement_index` equal to `mir.basic_blocks[location.block].statements.len()`](https://github.com/rust-lang/rust-clippy/blob/b8a9a507bf9e3149d287841454842116c72d66c4/clippy_utils/src/mir/mod.rs#L129), in which case the location would refer to the block terminator: https://github.com/rust-lang/rust-clippy/blob/b8a9a507bf9e3149d287841454842116c72d66c4/clippy_lints/src/dereference.rs#L1204-L1206 I suspect the bug is not triggerable now, because of checks leading up to where it occurs. But a future code change could make it triggerable. Hence, it should be fixed. r? `@Jarcho` changelog: none
2 parents 4612fdf + 524ec2e commit 967f172

File tree

2 files changed

+5
-6
lines changed

2 files changed

+5
-6
lines changed

clippy_lints/src/dereference.rs

+4-4
Original file line numberDiff line numberDiff line change
@@ -1192,16 +1192,16 @@ fn has_ref_mut_self_method(cx: &LateContext<'_>, trait_def_id: DefId) -> bool {
11921192
})
11931193
}
11941194

1195-
fn referent_used_exactly_once<'a, 'tcx>(
1196-
cx: &'a LateContext<'tcx>,
1195+
fn referent_used_exactly_once<'tcx>(
1196+
cx: &LateContext<'tcx>,
11971197
possible_borrowers: &mut Vec<(LocalDefId, PossibleBorrowerMap<'tcx, 'tcx>)>,
11981198
reference: &Expr<'tcx>,
11991199
) -> bool {
12001200
let mir = enclosing_mir(cx.tcx, reference.hir_id);
12011201
if let Some(local) = expr_local(cx.tcx, reference)
12021202
&& let [location] = *local_assignments(mir, local).as_slice()
1203-
&& let StatementKind::Assign(box (_, Rvalue::Ref(_, _, place))) =
1204-
mir.basic_blocks[location.block].statements[location.statement_index].kind
1203+
&& let Some(statement) = mir.basic_blocks[location.block].statements.get(location.statement_index)
1204+
&& let StatementKind::Assign(box (_, Rvalue::Ref(_, _, place))) = statement.kind
12051205
&& !place.has_deref()
12061206
{
12071207
let body_owner_local_def_id = cx.tcx.hir().enclosing_body_owner(reference.hir_id);

clippy_utils/src/mir/mod.rs

+1-2
Original file line numberDiff line numberDiff line change
@@ -121,8 +121,7 @@ pub fn expr_local(tcx: TyCtxt<'_>, expr: &Expr<'_>) -> Option<Local> {
121121
})
122122
}
123123

124-
/// Returns a vector of `mir::Location` where `local` is assigned. Each statement referred to has
125-
/// kind `StatementKind::Assign`.
124+
/// Returns a vector of `mir::Location` where `local` is assigned.
126125
pub fn local_assignments(mir: &Body<'_>, local: Local) -> Vec<Location> {
127126
let mut locations = Vec::new();
128127
for (block, data) in mir.basic_blocks.iter_enumerated() {

0 commit comments

Comments
 (0)