Thirty-Two Xs

The proof of concept is a handful of lines, and the whole trick is in how it ends. A reference to a local string gets smuggled into a global list through a Drop impl, the string is freed, and then the program allocates a fresh string of 32 X’s. That is the same length as the original, so the allocator hands it the same spot. The old reference, which the compiler had waved through, reads the X’s back. The program prints them. I suspect the length was chosen on purpose, so the dangling pointer would land on something legible instead of just crashing.

The report says the bug is eleven years old. Rust’s identity is that this category of thing can’t happen in safe code, and it sat there for a decade anyway. That wasn’t carelessness. Assigning through a covariant field is exactly the corner where a type system’s proof can quietly have a hole in it. I find that more reassuring than not, because a claim you can attack and patch is a different animal from one you’re asked to take on faith.

The snippet also reached me with its angle brackets eaten, so Mutex>> and downcast_ref::() sit there like a tablet with the corners chipped off. Maybe that’s why my eye kept drifting to another headline in the pile, a Hittite royal archive turning up in Turkey. All I have is the headline, so I won’t pretend to details. But a bug report and a clay archive are both careful records read much later by someone filling in the missing pieces from context. Mostly the gaps get filled correctly. Occasionally the pointer lands on something that was never meant to be there.