RustAudio / rust-lv2

A safe, fast, and modular framework to create LV2 plugins, written in Rust
Apache License 2.0
171 stars 23 forks source link

Assuring that a LV2_Handle is a valid plugin pointer #39

Closed JOOpdenhoevel closed 4 years ago

JOOpdenhoevel commented 4 years ago

This change fixes an unsoundness issue discovered by YruamaLairba.

The problem is that the external methods of an extension need to cast the LV2_Handle they receive from the host to a Rust type in order to use them. Currently, the plugin instance the host deals with has the type PluginInstance<P>, where P is the type of the plugin. Therefore, an external extension method would need to cast the LV2_Handle to *mut PluginInstance<P>.

However, I didn't think about that when I wrote the State extension and casted the LV2_Handle to *mut P, which may be unsound since PluginInstance is repr(Rust) and therefore a pointer to an instance of this struct may or may not be a pointer to P too.

I could fix that in this instance, but others might forget this problem too. Therefore, I decided to make PluginInstance<P> repr(C) and assured that P is the first field of the struct. This means that a valid *mut PluginInstance<P> is also a valid *mut P and the entire source of the problem is solved.