{"action":"created","issue":{"url":"https://api.github.com/repos/rust-lang/rust/issues/51117","repository_url":"https://api.github.com/repos/rust-lang/rust","labels_url":"https://api.github.com/repos/rust-lang/rust/issues/51117/labels{/name}","comments_url":"https://api.github.com/repos/rust-lang/rust/issues/51117/comments","events_url":"https://api.github.com/repos/rust-lang/rust/issues/51117/events","html_url":"https://github.com/rust-lang/rust/issues/51117","id":326861671,"node_id":"MDU6SXNzdWUzMjY4NjE2NzE=","number":51117,"title":"Borrowck allows two mutable borrows when using match ergonomics","user":{"login":"Arnavion","id":1096010,"node_id":"MDQ6VXNlcjEwOTYwMTA=","avatar_url":"https://avatars2.githubusercontent.com/u/1096010?v=4","gravatar_id":"","url":"https://api.github.com/users/Arnavion","html_url":"https://github.com/Arnavion","followers_url":"https://api.github.com/users/Arnavion/followers","following_url":"https://api.github.com/users/Arnavion/following{/other_user}","gists_url":"https://api.github.com/users/Arnavion/gists{/gist_id}","starred_url":"https://api.github.com/users/Arnavion/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Arnavion/subscriptions","organizations_url":"https://api.github.com/users/Arnavion/orgs","repos_url":"https://api.github.com/users/Arnavion/repos","events_url":"https://api.github.com/users/Arnavion/events{/privacy}","received_events_url":"https://api.github.com/users/Arnavion/received_events","type":"User","site_admin":false},"labels":[{"id":171502053,"node_id":"MDU6TGFiZWwxNzE1MDIwNTM=","url":"https://api.github.com/repos/rust-lang/rust/labels/A-borrow-checker","name":"A-borrow-checker","color":"d7e102","default":false},{"id":650731663,"node_id":"MDU6TGFiZWw2NTA3MzE2NjM=","url":"https://api.github.com/repos/rust-lang/rust/labels/C-bug","name":"C-bug","color":"f5f1fd","default":false},{"id":31942528,"node_id":"MDU6TGFiZWwzMTk0MjUyOA==","url":"https://api.github.com/repos/rust-lang/rust/labels/I-nominated","name":"I-nominated","color":"e10c02","default":false},{"id":267612997,"node_id":"MDU6TGFiZWwyNjc2MTI5OTc=","url":"https://api.github.com/repos/rust-lang/rust/labels/I-unsound%20%F0%9F%92%A5","name":"I-unsound 💥","color":"e11d21","default":false},{"id":867483626,"node_id":"MDU6TGFiZWw4Njc0ODM2MjY=","url":"https://api.github.com/repos/rust-lang/rust/labels/NLL-fixed-by-NLL","name":"NLL-fixed-by-NLL","color":"f799ea","default":false},{"id":211668100,"node_id":"MDU6TGFiZWwyMTE2NjgxMDA=","url":"https://api.github.com/repos/rust-lang/rust/labels/T-compiler","name":"T-compiler","color":"bfd4f2","default":false},{"id":262252840,"node_id":"MDU6TGFiZWwyNjIyNTI4NDA=","url":"https://api.github.com/repos/rust-lang/rust/labels/regression-from-stable-to-stable","name":"regression-from-stable-to-stable","color":"e4008a","default":false}],"state":"open","locked":false,"assignee":{"login":"nikomatsakis","id":155238,"node_id":"MDQ6VXNlcjE1NTIzOA==","avatar_url":"https://avatars0.githubusercontent.com/u/155238?v=4","gravatar_id":"","url":"https://api.github.com/users/nikomatsakis","html_url":"https://github.com/nikomatsakis","followers_url":"https://api.github.com/users/nikomatsakis/followers","following_url":"https://api.github.com/users/nikomatsakis/following{/other_user}","gists_url":"https://api.github.com/users/nikomatsakis/gists{/gist_id}","starred_url":"https://api.github.com/users/nikomatsakis/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nikomatsakis/subscriptions","organizations_url":"https://api.github.com/users/nikomatsakis/orgs","repos_url":"https://api.github.com/users/nikomatsakis/repos","events_url":"https://api.github.com/users/nikomatsakis/events{/privacy}","received_events_url":"https://api.github.com/users/nikomatsakis/received_events","type":"User","site_admin":false},"assignees":[{"login":"nikomatsakis","id":155238,"node_id":"MDQ6VXNlcjE1NTIzOA==","avatar_url":"https://avatars0.githubusercontent.com/u/155238?v=4","gravatar_id":"","url":"https://api.github.com/users/nikomatsakis","html_url":"https://github.com/nikomatsakis","followers_url":"https://api.github.com/users/nikomatsakis/followers","following_url":"https://api.github.com/users/nikomatsakis/following{/other_user}","gists_url":"https://api.github.com/users/nikomatsakis/gists{/gist_id}","starred_url":"https://api.github.com/users/nikomatsakis/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nikomatsakis/subscriptions","organizations_url":"https://api.github.com/users/nikomatsakis/orgs","repos_url":"https://api.github.com/users/nikomatsakis/repos","events_url":"https://api.github.com/users/nikomatsakis/events{/privacy}","received_events_url":"https://api.github.com/users/nikomatsakis/received_events","type":"User","site_admin":false}],"milestone":null,"comments":11,"created_at":"2018-05-27T23:44:34Z","updated_at":"2018-05-30T19:16:19Z","closed_at":null,"author_association":"NONE","body":"... which can be used to trigger a UAF in safe code.\r\n\r\n```\r\nrustc 1.26.0 (a77568041 2018-05-07)\r\nbinary: rustc\r\ncommit-hash: a7756804103447ea4e68a71ccf071e7ad8f7a03e\r\ncommit-date: 2018-05-07\r\nhost: x86_64-pc-windows-msvc\r\nrelease: 1.26.0\r\nLLVM version: 6.0\r\n```\r\n\r\n```rust\r\nfn main() {\r\n    let mut foo = Some(\"foo\".to_string());\r\n    let bar = &mut foo;\r\n    match bar {\r\n        Some(baz) => {\r\n            bar.take();\r\n            println!(\"{:?}\", baz); // UAF, segfaults or prints garbage\r\n        },\r\n        None => unreachable!(),\r\n    }\r\n}\r\n```\r\n\r\n---\r\n\r\nOriginal repro:\r\n\r\n```rust\r\nenum CacheFuture {\r\n    Get(Option<String>)\r\n}\r\n\r\nfn main() {\r\n    let mut f = CacheFuture::Get(Some(\"foo\".to_string()));\r\n    match &mut f {\r\n        CacheFuture::Get(get) => match get {\r\n            Some(mod_name) => {\r\n                get.take();\r\n                println!(\"{:?}\", mod_name); // UAF, segfaults or prints garbage\r\n            },\r\n            None => unreachable!(),\r\n        },\r\n    }\r\n}\r\n```\r\n\r\n---\r\n\r\nInserting explicit annotations to disable match ergonomics leads to borrowck correctly complaining about two mutable borrows, which leads me to believe this is only because of match ergonomics.\r\n\r\n```rust\r\nenum CacheFuture {\r\n    Get(Option<String>)\r\n}\r\n\r\nfn main() {\r\n    let mut f = CacheFuture::Get(Some(\"foo\".to_string()));\r\n    match *(&mut f) {\r\n        CacheFuture::Get(ref mut get) => match *get {\r\n            Some(ref mut mod_name) => {\r\n                get.take();\r\n                println!(\"{:?}\", mod_name);\r\n            },\r\n            None => unreachable!(),\r\n        },\r\n    }\r\n}\r\n```\r\n\r\n```\r\n9  |             Some(ref mut mod_name) => {\r\n   |                  ---------------- first mutable borrow occurs here\r\n10 |                 get.take();\r\n   |                 ^^^ second mutable borrow occurs here\r\n...\r\n14 |         },\r\n   |         - first borrow ends here\r\n```"},"comment":{"url":"https://api.github.com/repos/rust-lang/rust/issues/comments/393283992","html_url":"https://github.com/rust-lang/rust/issues/51117#issuecomment-393283992","issue_url":"https://api.github.com/repos/rust-lang/rust/issues/51117","id":393283992,"node_id":"MDEyOklzc3VlQ29tbWVudDM5MzI4Mzk5Mg==","user":{"login":"nikomatsakis","id":155238,"node_id":"MDQ6VXNlcjE1NTIzOA==","avatar_url":"https://avatars0.githubusercontent.com/u/155238?v=4","gravatar_id":"","url":"https://api.github.com/users/nikomatsakis","html_url":"https://github.com/nikomatsakis","followers_url":"https://api.github.com/users/nikomatsakis/followers","following_url":"https://api.github.com/users/nikomatsakis/following{/other_user}","gists_url":"https://api.github.com/users/nikomatsakis/gists{/gist_id}","starred_url":"https://api.github.com/users/nikomatsakis/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nikomatsakis/subscriptions","organizations_url":"https://api.github.com/users/nikomatsakis/orgs","repos_url":"https://api.github.com/users/nikomatsakis/repos","events_url":"https://api.github.com/users/nikomatsakis/events{/privacy}","received_events_url":"https://api.github.com/users/nikomatsakis/received_events","type":"User","site_admin":false},"created_at":"2018-05-30T19:16:19Z","updated_at":"2018-05-30T19:16:19Z","author_association":"CONTRIBUTOR","body":"I see, I see. Yes, of course. That helps! thanks."}}
{"actor":{"display_login":"nikomatsakis"}}