forked from BigfootDev/flatbuffers
Artyom Palvelev
5eb190f000
In the FlatBuffers binary wire format specification, every scalar field is
aligned to its own byte size (`1`, `2`, `4`, or `8` bytes), regardless of the
host CPU architecture. Both the `flatc` schema compiler (when computing table
`max_align` and struct field offsets) and the C++ `FlatBufferBuilder::Align` /
`PushElement` implementation align 64-bit scalars (`u64`, `i64`, `f64`) to 8
bytes on all architectures.
However, in the Rust `flatbuffers` crate (`rust/flatbuffers/src/push.rs`), the
`Push` trait provides a default implementation:
```rust
fn alignment() -> PushAlignment {
PushAlignment::new(align_of::<Self::Output>())
}
```
And `impl_push_for_endian_scalar!` did not override `Push::alignment()`,
inheriting `core::mem::align_of::<T>()` for all primitive scalar types (`bool`,
`u8`, `i8`, `u16`, `i16`, `u32`, `i32`, `u64`, `i64`, `f32`, `f64`).
On 64-bit targets (`x86_64`, `aarch64`) and 32-bit ARM (`armv7`),
`align_of::<u64>() == 8`, so `align_of::<T>()` happens to equal `size_of::<T>()`.
On 32-bit x86 (`i686`, System V i386 ABI), however, the host ABI alignment of
64-bit scalars (`u64`, `i64`, `f64`) is **4 bytes** (`align_of::<u64>() == 4`),
while their FlatBuffer wire-format size and required wire alignment is **8
bytes** (`size_of::<u64>() == 8`).
As a consequence, on 32-bit x86 (`i686`):
1. `FlatBufferBuilder::push::<u64 / i64 / f64>` only aligns the builder's cursor
and tracks `min_align` to 4 bytes instead of 8 bytes when writing 64-bit
table fields or vectors of 64-bit scalars.
2. When a table containing a 64-bit scalar field (`uint64`, `int64`, `double`)
is serialized on `i686`, the field can be placed at a buffer offset that is
4-byte aligned but not 8-byte aligned.
3. When the resulting FlatBuffer is verified by C++ `flatbuffers::Verifier`
(which checks `VerifyField<uint64_t>` with `sizeof(uint64_t) == 8` alignment
when `FLATBUFFERS_TRACK_VERIFIER_BUFFER_SIZE` / alignment checks are active)
or transferred to a 64-bit reader, verification fails or unaligned 64-bit
reads occur.
Fix `impl_push_for_endian_scalar!` to explicitly implement `Push::alignment()`
using `size_of::<$ty>()` so that all endian scalar types always use their
wire-format byte size as their FlatBuffer alignment across all target
architectures.
126 lines
3.6 KiB
Rust
126 lines
3.6 KiB
Rust
/*
|
|
* Copyright 2018 Google Inc. All rights reserved.
|
|
*
|
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
* you may not use this file except in compliance with the License.
|
|
* You may obtain a copy of the License at
|
|
*
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
*
|
|
* Unless required by applicable law or agreed to in writing, software
|
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
* See the License for the specific language governing permissions and
|
|
* limitations under the License.
|
|
*/
|
|
|
|
use core::cmp::max;
|
|
use core::mem::{align_of, size_of};
|
|
|
|
use crate::endian_scalar::emplace_scalar;
|
|
|
|
/// Trait to abstract over functionality needed to write values (either owned
|
|
/// or referenced). Used in FlatBufferBuilder and implemented for generated
|
|
/// types.
|
|
pub trait Push: Sized {
|
|
type Output;
|
|
|
|
/// # Safety
|
|
///
|
|
/// dst is aligned to [`Self::alignment`] and has length greater than or equal to [`Self::size`]
|
|
unsafe fn push(&self, dst: &mut [u8], written_len: usize);
|
|
#[inline]
|
|
fn size() -> usize {
|
|
size_of::<Self::Output>()
|
|
}
|
|
#[inline]
|
|
fn alignment() -> PushAlignment {
|
|
PushAlignment::new(align_of::<Self::Output>())
|
|
}
|
|
}
|
|
|
|
impl<'a, T: Push> Push for &'a T {
|
|
type Output = T::Output;
|
|
|
|
unsafe fn push(&self, dst: &mut [u8], written_len: usize) {
|
|
T::push(self, dst, written_len)
|
|
}
|
|
|
|
fn size() -> usize {
|
|
T::size()
|
|
}
|
|
|
|
fn alignment() -> PushAlignment {
|
|
T::alignment()
|
|
}
|
|
}
|
|
|
|
/// Ensure Push alignment calculations are typesafe (because this helps reduce
|
|
/// implementation issues when using FlatBufferBuilder::align).
|
|
pub struct PushAlignment(usize);
|
|
impl PushAlignment {
|
|
#[inline]
|
|
pub fn new(x: usize) -> Self {
|
|
PushAlignment(x)
|
|
}
|
|
#[inline]
|
|
pub fn value(&self) -> usize {
|
|
self.0
|
|
}
|
|
#[inline]
|
|
pub fn max_of(&self, o: usize) -> Self {
|
|
PushAlignment::new(max(self.0, o))
|
|
}
|
|
}
|
|
|
|
/// Macro to implement Push for EndianScalar types.
|
|
macro_rules! impl_push_for_endian_scalar {
|
|
($ty:ident) => {
|
|
impl Push for $ty {
|
|
type Output = $ty;
|
|
|
|
#[inline]
|
|
unsafe fn push(&self, dst: &mut [u8], _written_len: usize) {
|
|
emplace_scalar::<$ty>(dst, *self);
|
|
}
|
|
|
|
#[inline]
|
|
fn alignment() -> PushAlignment {
|
|
PushAlignment::new(size_of::<$ty>())
|
|
}
|
|
}
|
|
};
|
|
}
|
|
|
|
impl_push_for_endian_scalar!(bool);
|
|
impl_push_for_endian_scalar!(u8);
|
|
impl_push_for_endian_scalar!(i8);
|
|
impl_push_for_endian_scalar!(u16);
|
|
impl_push_for_endian_scalar!(i16);
|
|
impl_push_for_endian_scalar!(u32);
|
|
impl_push_for_endian_scalar!(i32);
|
|
impl_push_for_endian_scalar!(u64);
|
|
impl_push_for_endian_scalar!(i64);
|
|
impl_push_for_endian_scalar!(f32);
|
|
impl_push_for_endian_scalar!(f64);
|
|
|
|
#[cfg(test)]
|
|
mod tests {
|
|
use super::*;
|
|
|
|
#[test]
|
|
fn endian_scalar_push_alignment_matches_wire_size() {
|
|
assert_eq!(<bool as Push>::alignment().value(), 1);
|
|
assert_eq!(<u8 as Push>::alignment().value(), 1);
|
|
assert_eq!(<i8 as Push>::alignment().value(), 1);
|
|
assert_eq!(<u16 as Push>::alignment().value(), 2);
|
|
assert_eq!(<i16 as Push>::alignment().value(), 2);
|
|
assert_eq!(<u32 as Push>::alignment().value(), 4);
|
|
assert_eq!(<i32 as Push>::alignment().value(), 4);
|
|
assert_eq!(<f32 as Push>::alignment().value(), 4);
|
|
assert_eq!(<u64 as Push>::alignment().value(), 8);
|
|
assert_eq!(<i64 as Push>::alignment().value(), 8);
|
|
assert_eq!(<f64 as Push>::alignment().value(), 8);
|
|
}
|
|
}
|