Use Box<[T]> instead of Vec<T> to initialize and drop ArrayQueue

[caelunshun]

Previously, the queue buffer was initialized using Vec::from_iter through collect. Note that collect does not guarantee a precise capacity; the layout of the allocated memory could have a greater size.

ArrayVec::drop assumed the buffer has a size equal to the queue's capacity. This is undefined behavior when the buffer actually has a different size thanks to Vec.

Using Box<[T]> instead guarantees an exact capacity, resolving the UB.

(The same fix should probably be applied to concurrent-queue as it suffers from the same bug.)

[Gilnaa]

The FromIterator impl that collect uses for Box<[T]> is

impl<A> FromIterator<A> for Box<[A]> {
    fn from_iter<T: IntoIterator<Item = A>>(iter: T) -> Self {
        iter.into_iter().collect::<Vec<_>>().into_boxed_slice()
    }
}

I might be wrong, but wouldn't this also result in bigger than needed allocation?

[caelunshun]

The FromIterator impl that collect uses for Box<[T]> is

impl<A> FromIterator<A> for Box<[A]> {
    fn from_iter<T: IntoIterator<Item = A>>(iter: T) -> Self {
        iter.into_iter().collect::<Vec<_>>().into_boxed_slice()
    }
}

I might be wrong, but wouldn't this also result in bigger than needed allocation?

into_boxed_slice will shrink the allocation's size to the length of the slice:

unsafe {
    self.shrink_to_fit();
    let me = ManuallyDrop::new(self);
    let buf = ptr::read(&me.buf);
    let len = me.len();
    buf.into_box(len).assume_init()
}

Notice the call to shrink_to_fit.

[ghost]

Thank you!

[taiki-e]

@rocallahan crossbeam-channel 0.4.4 is like removing the commit that introduced the UB fixed by this PR from 0.4.3.
So "incorrect layout on deallocation" UB shouldn't exist in that version. (Could you check the output of cargo tree | grep 'crossbeam-channel'?)

[rocallahan]

Yes, I just figured that out and deleted my comment, sorry.

I was confused because I couldn't find the commit from this PR under the crossbeam-channel-0.4.4 tag. I also looked at the 0.4.4 crates.io source and misunderstood the code there. Thanks!

[rocallahan]

I do think it would be good if fixes for critical bugs like this can make it into a release more quickly. It was more than two months from this bug being discovered and the fix submitted (late June) to 0.4.4 being released and 0.4.3 being yanked (early September). We updated to 0.4.3 in the meantime and I guess a lot of other projects did too.

[tomrittervg]

Would it be possible to request a CVE from Github for this issue?

[taiki-e]

@tomrittervg I've filed advisory in rustsec/advisory-db#425. (And I'll request a CVE from Github.)

[taiki-e]

Security advisory is now published as RUSTSEC-2020-0052 / GHSA-v5m7-53cv-f3hx / CVE-2020-15254.