io: extend Buf length only after having read into it

[paolobarbolini]

Motivation

I've discovered that Buf::ensure_capacity_for is unsound because it uses Vec::set_len to grow the Vec past the init area. This violates the documented safety invariants of Vec::set_len, which say The elements at old_len..new_len must be initialized.

This can be tested very easily by adding for &byte in &self.buf {} after the self.buf.set_len call.

Solution

Have reads use the spare capacity of buf and Vec::set_len afterwards.

[Darksonn]

Please add a test that would catch the unsoundness in question if run under miri.

[Darksonn]

I don't think this qualifies as a security issue, because Blocking is only used internally with stdlib types that don't read from the buffer passed to read. It's a similar situation to this:

tokio/tokio/src/io/poll_evented.rs

Lines 168 to 169 in 9d42b97

	// Safety: The caller must ensure that `E` can read into uninitialized memory
	pub(crate) unsafe fn poll_read<'a>(

Still, I agree that the particular implementation is not the greatest. We should avoid calling set_len until after actually filling the data with read. The constructor of Buf should also unsafely assert that the IO resource doesn't read from the slice in read.

[paolobarbolini]

I'm not too happy about the current &mut [MaybeUninit<u8>] -> &mut [u8] hacks but given that everything else also relies on it I've changed it here too

[Darksonn]

Thanks a lot. Looks quite reasonable. Just a few minor nits remaining.

[Darksonn]

I'm going to make a release as soon as this is merged.

[Darksonn]

Thank you.