|
13 | 13 | :scope: system |
14 | 14 | :tags: undefined-behavior, unsafe |
15 | 15 |
|
16 | | - Do not read uninitialized memory of any non-union type as a typed value |
17 | | - :cite:`RUSTNOMICON_UNINIT`. |
| 16 | + Do not read uninitialized memory of any non-union type as a typed value :cite:`gui_xK9pLm2nQR4t:RUSTNOMICON-UNINIT`. |
18 | 17 | This is sometimes referred to as *transmuting* or *read-at-type*. |
19 | 18 | Memory can remain uninitialized if it is not read as a type. |
20 | 19 |
|
21 | 20 | Reading from a union is covered by `Do not read from union fields that may contain uninitialized bytes |
22 | 21 | <https://coding-guidelines.arewesafetycriticalyet.org/coding-guidelines/types-and-traits/index.html#gui_UnionPartialInit>`_. |
23 | 22 |
|
24 | 23 | Calling `assume_init <https://doc.rust-lang.org/stable/std/mem/union.MaybeUninit.html#method.assume_init>`_ |
25 | | - :cite:`MAYBEUNINIT_DOC` or any of the following related functions is treated in the same manner as a typed read: |
| 24 | + :cite:`gui_aE3fNc6dWX1v:MAYBEUNINIT-DOC` or any of the following related functions is treated in the same manner as a typed read: |
26 | 25 |
|
27 | 26 | * ``assume_init_drop`` |
28 | 27 | * ``assume_init_mut`` |
29 | 28 | * ``assume_init_read`` |
30 | 29 | * ``assume_init_ref`` |
31 | 30 | * ``array_assume_init`` |
32 | 31 |
|
33 | | - Calling any of these function on memory that is not yet fully initialized is undefined behavior :cite:`RUST_REF_BEHAVIOR`. |
34 | | - The memory must be properly initialized according to the requirements of the variable's type :cite:`UCG_VALIDITY`. |
| 32 | + Calling any of these function on memory that is not yet fully initialized is undefined behavior :cite:`gui_vB7sHj5wYZ8u:RUST-REF-BEHAVIOR`. |
| 33 | + The memory must be properly initialized according to the requirements of the variable's type :cite:`gui_uZ0zDq8rST1b:UCG-VALIDITY`. |
35 | 34 | For example, a variable of reference type must be aligned, non-null, and point to valid memory. |
36 | 35 | Similarly, entirely uninitialized memory may have any content, while a ``bool`` must always be ``true`` or ``false``. |
37 | 36 | Consequently, reading an uninitialized ``bool`` is undefined behavior. |
|
40 | 39 | :id: rat_kjFRrhpS8Wu6 |
41 | 40 | :status: draft |
42 | 41 |
|
43 | | - Rust's memory model requires that all bytes must be initialized before being read as a typed value :cite:`RUSTNOMICON_UNINIT` :cite:`FERROCENE_SPEC`. |
44 | | - Reading uninitialized memory as a typed value is undefined behavior :cite:`RUST_REF_BEHAVIOR`. |
45 | | - This guideline aligns with functional safety standards :cite:`ISO_26262` :cite:`IEC_61508` and secure coding practices :cite:`CERT_RUST`. |
46 | | - |
| 42 | + Rust's memory model requires that all bytes must be initialized before being read as a typed value |
| 43 | + :cite:`gui_xK9pLm2nQR4t:RUSTNOMICON-UNINIT` :cite:`gui_kP8qTg4hUS2w:FERROCENE-SPEC`. |
| 44 | + Reading uninitialized memory as a typed value is undefined behavior :cite:`gui_vB7sHj5wYZ8u:RUST-REF-BEHAVIOR`. |
| 45 | + This guideline aligns with functional safety standards :cite:`gui_oT4tXk2lMN5y:ISO-26262` |
| 46 | + :cite:`gui_qV6vZm4nOP7z:IEC-61508` and secure coding practices. |
| 47 | + |
47 | 48 | .. non_compliant_example:: |
48 | 49 | :id: non_compl_ex_Qb5GqYTP6db1 |
49 | 50 | :status: draft |
|
86 | 87 | :status: draft |
87 | 88 |
|
88 | 89 | This noncompliant example creates a pointer from uninitialized memory. |
89 | | - Not all bit patterns are valid pointers for all operations (e.g., provenance rules) :cite:`UCG_VALIDITY`. |
| 90 | + Not all bit patterns are valid pointers for all operations (e.g., provenance rules) :cite:`gui_uZ0zDq8rST1b:UCG-VALIDITY`. |
90 | 91 | You cannot create a pointer from unspecified bytes. |
91 | | - Even a raw pointer type (e.g., ``*const T``) has validity rules :cite:`RUST_REF_BEHAVIOR`. |
| 92 | + Even a raw pointer type (e.g., ``*const T``) has validity rules `gui_vB7sHj5wYZ8u:RUST-REF-BEHAVIOR`. |
92 | 93 |
|
93 | 94 | .. rust-example:: |
94 | 95 |
|
|
103 | 104 | :status: draft |
104 | 105 |
|
105 | 106 | This noncompliant example creates a reference from uninitialized memory. |
106 | | - Creating a reference from arbitrary or uninitialized bytes is undefined behavior :cite:`RUST_REF_BEHAVIOR`. |
107 | | - References must be valid, aligned, dereferenceable, and non-null :cite:`UCG_VALIDITY`. |
| 107 | + Creating a reference from arbitrary or uninitialized bytes is undefined behavior :cite:`gui_vB7sHj5wYZ8u:RUST-REF-BEHAVIOR`. |
| 108 | + References must be valid, aligned, dereferenceable, and non-null :cite:`gui_uZ0zDq8rST1b:UCG-VALIDITY`. |
108 | 109 | Uninitialized memory cannot satisfy these requirements. |
109 | 110 |
|
110 | 111 | .. rust-example:: |
|
226 | 227 | } |
227 | 228 |
|
228 | 229 | .. bibliography:: |
229 | | - :id: bib_LoopTerminate |
| 230 | + :id: bib_WNCi5njUWLuY |
230 | 231 | :status: draft |
231 | 232 |
|
232 | 233 | .. list-table:: |
233 | 234 | :header-rows: 0 |
234 | 235 | :widths: auto |
235 | 236 | :class: bibliography-table |
236 | 237 |
|
237 | | - * - .. [DO-178C] |
238 | | - - | RTCA, Inc. |
239 | | - | "DO-178C: Software Considerations in Airborne Systems and Equipment Certification." |
240 | | - | https://store.accuristech.com/standards/rtca-do-178c?product_id=2200105 |
241 | | - |
242 | | - * - .. [RUSTNOMICON_UNINIT] |
243 | | - - | The Rust Project Developers |
244 | | - | "The Rustonomicon - Uninitialized Memory" |
245 | | - | https://doc.rust-lang.org/nomicon/uninitialized.html |
246 | | - |
247 | | - * - .. [RUST_REF_BEHAVIOR] |
248 | | - - | The Rust Project Developers |
249 | | - | "The Rust Reference - Behavior considered undefined" |
250 | | - | https://doc.rust-lang.org/reference/behavior-considered-undefined.html |
251 | | - |
252 | | - * - .. [MAYBEUNINIT_DOC] |
253 | | - - | The Rust Project Developers |
254 | | - | "std::mem::MaybeUninit - Rust Standard Library Documentation" |
255 | | - | https://doc.rust-lang.org/stable/std/mem/union.MaybeUninit.html |
256 | | - |
257 | | - * - .. [FERROCENE_SPEC] |
258 | | - - | Ferrocene GmbH |
259 | | - | "Ferrocene Language Specification" |
260 | | - | https://spec.ferrocene.dev/ |
261 | | - |
262 | | - * - .. [MISRA_RUST] |
263 | | - - | MISRA Consortium Limited |
264 | | - | "MISRA Rust Guidelines (Draft)" |
265 | | - | https://misra.org.uk/ |
266 | | - |
267 | | - * - .. [ISO_26262] |
268 | | - - | International Organization for Standardization |
269 | | - | "ISO 26262 - Road vehicles - Functional safety" |
270 | | - | https://www.iso.org/standard/68383.html |
271 | | - |
272 | | - * - .. [IEC_61508] |
273 | | - - | International Electrotechnical Commission |
274 | | - | "IEC 61508 - Functional Safety of Electrical/Electronic/Programmable Electronic Safety-related Systems" |
275 | | - | https://www.iec.ch/functional-safety |
276 | | - |
277 | | - * - .. [RUST_SAFETY_CRITICAL_WG] |
278 | | - - | Rust Foundation |
279 | | - | "Rust Safety-Critical Consortium" |
280 | | - | https://github.com/rust-lang/safety-critical-consortium |
281 | | - |
282 | | - * - .. [UCG_VALIDITY] |
283 | | - - | The Rust Project Developers |
284 | | - | "Unsafe Code Guidelines - Validity Invariants" |
285 | | - | https://rust-lang.github.io/unsafe-code-guidelines/glossary.html#validity-and-safety-invariant |
| 238 | + * - :bibentry:`gui_wB2bFs0tUV3c:DO-178C` |
| 239 | + - RTCA, Inc. "DO-178C: Software Considerations in Airborne Systems and Equipment Certification." https://store.accuristech.com/standards/rtca-do-178c?product_id=2200105. |
| 240 | + |
| 241 | + * - :bibentry:`gui_xK9pLm2nQR4t:RUSTNOMICON-UNINIT` |
| 242 | + - The Rust Project Developers. "The Rustonomicon - Uninitialized Memory." https://doc.rust-lang.org/nomicon/uninitialized.html. |
| 243 | + |
| 244 | + * - :bibentry:`gui_vB7sHj5wYZ8u:RUST-REF-BEHAVIOR` |
| 245 | + - The Rust Project Developers. "The Rust Reference - Behavior considered undefined." https://doc.rust-lang.org/reference/behavior-considered-undefined.html. |
| 246 | + |
| 247 | + * - :bibentry:`gui_aE3fNc6dWX1v:MAYBEUNINIT-DOC` |
| 248 | + - The Rust Project Developers. "std::mem::MaybeUninit - Rust Standard Library Documentation." https://doc.rust-lang.org/stable/std/mem/union.MaybeUninit.html. |
| 249 | + |
| 250 | + * - :bibentry:`gui_kP8qTg4hUS2w:FERROCENE-SPEC` |
| 251 | + - Ferrocene GmbH. "Ferrocene Language Specification." https://spec.ferrocene.dev/. |
| 252 | + |
| 253 | + * - :bibentry:`gui_mR1rVi9jKL3x:MISRA-RUST` |
| 254 | + - MISRA Consortium Limited. "MISRA Rust Guidelines (Draft)." https://misra.org.uk/. |
| 255 | + |
| 256 | + * - :bibentry:`gui_oT4tXk2lMN5y:ISO-26262` |
| 257 | + - International Organization for Standardization. "ISO 26262 - Road vehicles - Functional safety." https://www.iso.org/standard/68383.html. |
| 258 | + |
| 259 | + * - :bibentry:`gui_qV6vZm4nOP7z:IEC-61508` |
| 260 | + - International Electrotechnical Commission. "IEC 61508 - Functional Safety of Electrical/Electronic/Programmable Electronic Safety-related Systems." https://www.iec.ch/functional-safety. |
| 261 | + |
| 262 | + * - :bibentry:`gui_sX8xBo6pQR9a:RUST-SAFETY-CRITICAL-WG` |
| 263 | + - Rust Foundation. "Rust Safety-Critical Consortium." https://github.com/rust-lang/safety-critical-consortium. |
| 264 | + |
| 265 | + * - :bibentry:`gui_uZ0zDq8rST1b:UCG-VALIDITY` |
| 266 | + - The Rust Project Developers. "Unsafe Code Guidelines - Validity Invariants." https://rust-lang.github.io/unsafe-code-guidelines/glossary.html#validity-and-safety-invariant. |
| 267 | + |
286 | 268 |
|
287 | 269 | * - .. [CERT_RUST] |
288 | 270 | - | Carnegie Mellon University Software Engineering Institute |
|
0 commit comments