Skip to content

cext: fix UB writing to uninitialized buffers in transpile_layout C API#16590

Open
shofiqtest wants to merge 1 commit into
Qiskit:mainfrom
shofiqtest:fix/uninitialized-buffer-memory-safety-15370
Open

cext: fix UB writing to uninitialized buffers in transpile_layout C API#16590
shofiqtest wants to merge 1 commit into
Qiskit:mainfrom
shofiqtest:fix/uninitialized-buffer-memory-safety-15370

Conversation

@shofiqtest

Copy link
Copy Markdown

Summary

Fixes #15370.

As identified by @jakelishman in #15297 (comment), the three layout query functions in crates/cext/src/transpiler/transpile_layout.rs create a &mut [u32] slice over caller-provided uninitialized memory, which violates Rust's validity invariants even for write-only access.

Functions fixed:

  • qk_transpile_layout_initial_layout
  • qk_transpile_layout_output_permutation
  • qk_transpile_layout_final_layout

Change

Replace std::slice::from_raw_parts_mut + iterator pattern with direct raw pointer writes using ptr.add(i).write(value):

// Before (UB — slice over uninitialized memory)
let out_slice = std::slice::from_raw_parts_mut(ptr, len);
out_slice.iter_mut().zip(data.iter()).for_each(|(dest, src)| *dest = src.0);

// After (safe — raw pointer write, no reference to uninitialized memory)
for (i, src) in data.iter().enumerate() {
    ptr.add(i).write(src.0);
}

The bug is only caught by Miri with -Zmiri-recursive-validation, which explains why existing tests pass.

Test

Built cleanly with cargo build -p qiskit-cext. Existing tests unchanged.

Replace std::slice::from_raw_parts_mut over caller-provided uninitialized
buffers with direct pointer writes using ptr.add(i).write(). Creating a
Rust slice reference over uninitialized memory violates Rusts validity
invariants even for write-only access, as caught by Miri with
-Zmiri-recursive-validation.

Fixes Qiskit#15370
@shofiqtest
shofiqtest requested a review from a team as a code owner July 15, 2026 09:45
@qiskit-bot qiskit-bot added the Community PR PRs from contributors that are not 'members' of the Qiskit repo label Jul 15, 2026
@qiskit-bot

Copy link
Copy Markdown
Collaborator

Thank you for opening a new pull request.

Before your PR can be merged it will first need to pass continuous integration tests and be reviewed. Sometimes the review process can be slow, so please be patient.

While you're waiting, please feel free to review other open PRs. While only a subset of people are authorized to approve pull requests for merging, everyone is encouraged to review open pull requests. Doing reviews helps reduce the burden on the core team and helps make the project's code better for everyone.

One or more of the following people are relevant to this code:

  • @Qiskit/terra-core

@CLAassistant

CLAassistant commented Jul 15, 2026

Copy link
Copy Markdown

CLA assistant check
All committers have signed the CLA.

@CLAassistant

Copy link
Copy Markdown

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
You have signed the CLA already but the status is still pending? Let us recheck it.

@alexanderivrii alexanderivrii left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for doing this, @shofiqtest. We already have an open PR for this (see #15375), but it looks like the contributor stopped working on it. If he does not reply within a few days, you are welcome to take over with this PR. Please see this comment #15375 (review), as it is relevant for this PR as well. In addition, please add LLM attribution to the PR summary.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Community PR PRs from contributors that are not 'members' of the Qiskit repo

Projects

Status: No status

Development

Successfully merging this pull request may close these issues.

Improve memory safety when writing to uninitialized buffers in C API

4 participants