A GitHub issue reports that the Rust compiler accepts safe code that causes use-after-free errors. Commenters say variants of the problem have compiled since at least Rust 1.4.
A new issue in the Rust repository, number 164250, describes a soundness hole in the compiler. The reporter shows a short program that should be rejected but compiles and prints the wrong data. When built with AddressSanitizer, it crashes with a stack-use-after-scope error. The reporter says the problem appears on current nightly and on stable releases at least as far back as 1.85.0.
The example uses a struct with a lifetime requirement such as 'static on a type parameter, plus a Drop implementation. A field is first set to None and later assigned a reference to a local value. The compiler does not enforce the struct's lifetime requirement in this case. As a result, code inside drop can treat a short-lived reference as if it lived for the whole program.
Other participants posted variants. Some do not use a static variable, and one uses a closure that stores a dangling reference. Commenters reported that versions of the code compile on releases going back to 1.18.0 and even 1.4. One user suggested that type unification in general does not check lifetime bounds. Another posted an array-based example that does not assign to a field directly. Miri reports undefined behavior on that example, even though it contains no unsafe blocks.
The issue was labeled as unsound and assigned to the borrow checker, destructors, lifetimes and variance areas. After a discussion on Zulip, it was given high priority.
Source: Hacker News (front page)
