transmuting_null: Add checks for without_provenance and without_provenance_mut (#16336)

changelog: [`transmuting_null`]: now checks for
[`ptr::without_provenance`](https://doc.rust-lang.org/core/ptr/fn.without_provenance.html)
and
[`ptr::without_provenance_mut`](https://doc.rust-lang.org/core/ptr/fn.without_provenance_mut.html)
which create null pointers
This commit is contained in:
Samuel Tardieu 2026-01-09 10:59:07 +00:00 committed by GitHub
commit b4dea7c1c8
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 36 additions and 1 deletions

View file

@ -42,6 +42,18 @@ pub(super) fn check<'tcx>(cx: &LateContext<'tcx>, expr: &'tcx Expr<'_>, arg: &'t
return true;
}
// Catching:
// `std::mem::transmute(std::ptr::without_provenance::<i32>(0))`
// `std::mem::transmute(std::ptr::without_provenance_mut::<i32>(0))`
if let ExprKind::Call(func1, [arg1]) = arg.kind
&& (func1.basic_res().is_diag_item(cx, sym::ptr_without_provenance)
|| func1.basic_res().is_diag_item(cx, sym::ptr_without_provenance_mut))
&& is_integer_const(cx, arg1, 0)
{
span_lint(cx, TRANSMUTING_NULL, expr.span, LINT_MSG);
return true;
}
// Catching:
// `std::mem::transmute({ 0 as *const u64 })` and similar const blocks
if let ExprKind::Block(block, _) = arg.kind

View file

@ -47,9 +47,20 @@ fn transumute_single_expr_blocks() {
}
}
fn transmute_pointer_creators() {
unsafe {
let _: &u64 = std::mem::transmute(std::ptr::without_provenance::<u64>(0));
//~^ transmuting_null
let _: &u64 = std::mem::transmute(std::ptr::without_provenance_mut::<u64>(0));
//~^ transmuting_null
}
}
fn main() {
one_liners();
transmute_const();
transmute_const_int();
transumute_single_expr_blocks();
transmute_pointer_creators();
}

View file

@ -37,5 +37,17 @@ error: transmuting a known null pointer into a reference
LL | let _: &u64 = std::mem::transmute(const { u64::MIN as *const u64 });
| ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
error: aborting due to 6 previous errors
error: transmuting a known null pointer into a reference
--> tests/ui/transmuting_null.rs:52:23
|
LL | let _: &u64 = std::mem::transmute(std::ptr::without_provenance::<u64>(0));
| ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
error: transmuting a known null pointer into a reference
--> tests/ui/transmuting_null.rs:55:23
|
LL | let _: &u64 = std::mem::transmute(std::ptr::without_provenance_mut::<u64>(0));
| ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
error: aborting due to 8 previous errors