cext: fix UB writing to uninitialized buffers in transpile_layout C API#16590
cext: fix UB writing to uninitialized buffers in transpile_layout C API#16590shofiqtest wants to merge 1 commit into
Conversation
Replace std::slice::from_raw_parts_mut over caller-provided uninitialized buffers with direct pointer writes using ptr.add(i).write(). Creating a Rust slice reference over uninitialized memory violates Rusts validity invariants even for write-only access, as caught by Miri with -Zmiri-recursive-validation. Fixes Qiskit#15370
|
Thank you for opening a new pull request. Before your PR can be merged it will first need to pass continuous integration tests and be reviewed. Sometimes the review process can be slow, so please be patient. While you're waiting, please feel free to review other open PRs. While only a subset of people are authorized to approve pull requests for merging, everyone is encouraged to review open pull requests. Doing reviews helps reduce the burden on the core team and helps make the project's code better for everyone. One or more of the following people are relevant to this code:
|
|
|
alexanderivrii
left a comment
There was a problem hiding this comment.
Thanks for doing this, @shofiqtest. We already have an open PR for this (see #15375), but it looks like the contributor stopped working on it. If he does not reply within a few days, you are welcome to take over with this PR. Please see this comment #15375 (review), as it is relevant for this PR as well. In addition, please add LLM attribution to the PR summary.
Summary
Fixes #15370.
As identified by @jakelishman in #15297 (comment), the three layout query functions in
crates/cext/src/transpiler/transpile_layout.rscreate a&mut [u32]slice over caller-provided uninitialized memory, which violates Rust's validity invariants even for write-only access.Functions fixed:
qk_transpile_layout_initial_layoutqk_transpile_layout_output_permutationqk_transpile_layout_final_layoutChange
Replace
std::slice::from_raw_parts_mut+ iterator pattern with direct raw pointer writes usingptr.add(i).write(value):The bug is only caught by Miri with
-Zmiri-recursive-validation, which explains why existing tests pass.Test
Built cleanly with
cargo build -p qiskit-cext. Existing tests unchanged.