Soundness Hole: Aliasing and Mutating static references in safe Rust

[CryZe]

fn static_val() -> &'static mut u8 {
    let ref mut x = 0;
    x
}

fn main() {
    let ref1 = static_val();
    let ref2 = static_val();
    *ref1 = 20;
    *ref2 = 32;
    println!("{}", ref1);
}

The variable x is a mutable reference to a u8 that is promoted to a &'static mut u8. By calling that function multiple times, you can alias the mutable reference in safe Rust.

[memoryruins]

fn static_table() -> &'static mut [u8; 20] {
    let ref mut table = [0; 20];
    table
}

fn main() {
    let table = static_table();
    table[4] = 20;
    println!("{:?}", table);
}

The above returns different arrays of values depending on stable, beta, or release channel. Only in debug does table[4] = 20; set the index's value to 20.

[memoryruins]

Neither examples compile before 1.21.0.

[jonas-schievink]

looks like #46557

[memoryruins]

It appears so. Enabling nll prevents it from compiling.

[CryZe]

Closing as it seems to be a duplicate