The bug allows you to "extend" any lifetime 'a to 'static in safe code:
This converts a reference with any lifetime into a 'static reference, which violates Rust's safety guarantees. Once you can do this, you can create dangling references, access freed memory, etc.
This is a type system bug, not just an implementation bug. From the discussions:
- The easy fix (banning contravariance in function arguments) would eliminate valid Rust programs
- The proper fix requires changes to how higher-ranked lifetime variables carry subtyping relations
- The Rust team chose to pursue the more rigorous solution as part of replacing the trait solver (the "Chalk" project)
N_Lens•1h ago
Repo is based on exploiting this bug - https://github.com/rust-lang/rust/issues/25860 (Open since 2015)
The bug allows you to "extend" any lifetime 'a to 'static in safe code:
This converts a reference with any lifetime into a 'static reference, which violates Rust's safety guarantees. Once you can do this, you can create dangling references, access freed memory, etc.
This is a type system bug, not just an implementation bug. From the discussions:
- The easy fix (banning contravariance in function arguments) would eliminate valid Rust programs
- The proper fix requires changes to how higher-ranked lifetime variables carry subtyping relations
- The Rust team chose to pursue the more rigorous solution as part of replacing the trait solver (the "Chalk" project)