Skip to content

Commit 29c1363

Browse files
committed
Merge #548: fix soundness issue with preallocated_gen_new
1e6eb6c shut clippy up (Andrew Poelstra) f961497 context: introduce unsafe `PreallocatedContext` trait (Andrew Poelstra) Pull request description: Stop this from being a generic function over all contexts, to only a function generic over contexts where we can bound the lifetime precisely. Introduces a new unsafe trait. I *believe* the only code this breaks was already unsound: * code that tried to use one of the `*Preallocated` context markers with an incorrect lifetime * code that tried to use `preallocated_gen_new` with a non-`*Preallocated` marker, which I believe we allowed before (I just noticed this now) and almost certainly would've led to UB on drop Fixes #543 ACKs for top commit: Kixunil: ACK 1e6eb6c tcharding: ACK 1e6eb6c Tree-SHA512: 44eb4637a2f86d5b16d40174cb9e27f37cf8eb4f29546159dbbdcd3326d01f9de2f500ba732376dd84e67ebc3528c709d2d4e2aceb8a329bcb9fb9d25c9b89cb
2 parents ca2dd93 + 1e6eb6c commit 29c1363

File tree

1 file changed

+14
-1
lines changed

1 file changed

+14
-1
lines changed

src/context.rs

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -307,7 +307,20 @@ unsafe impl<'buf> Context for AllPreallocated<'buf> {
307307
}
308308
}
309309

310-
impl<'buf, C: Context + 'buf> Secp256k1<C> {
310+
/// Trait marking that a particular context object internally points to
311+
/// memory that must outlive `'a`
312+
///
313+
/// # Safety
314+
/// This trait is used internally to gate which context markers can safely
315+
/// be used with the `preallocated_gen_new` function. Do not implement it
316+
/// on your own structures.
317+
pub unsafe trait PreallocatedContext<'a> {}
318+
319+
unsafe impl<'buf> PreallocatedContext<'buf> for AllPreallocated<'buf> {}
320+
unsafe impl<'buf> PreallocatedContext<'buf> for SignOnlyPreallocated<'buf> {}
321+
unsafe impl<'buf> PreallocatedContext<'buf> for VerifyOnlyPreallocated<'buf> {}
322+
323+
impl<'buf, C: Context + PreallocatedContext<'buf>> Secp256k1<C> {
311324
/// Lets you create a context with a preallocated buffer in a generic manner (sign/verify/all).
312325
pub fn preallocated_gen_new(buf: &'buf mut [AlignedType]) -> Result<Secp256k1<C>, Error> {
313326
#[cfg(target_arch = "wasm32")]

0 commit comments

Comments
 (0)