tree 316d0acab7c1025410cd7cb9cc6f6b9589247a15
parent 255fb2adf68116fd4918c3f0c735a4db2a5d08f5
author Matthew Dempsky <mdempsky@google.com> 1597293662 -0700
committer Matthew Dempsky <mdempsky@google.com> 1602874237 +0000

x/tools/go/analysis/passes/unsafeptr: report Header misuse

This CL updates unsafeptr to report about *x and &x expressions where
the pointed-to variable has type reflect.SliceHeader or
reflect.StringHeader.

- Disallowing *x means that reflect.{Slice,String}Header.Data can only
  be accessed using field selection via a *reflect.{Slice,String}Header
  value.

- Disallowing &x means that a *reflect.{Slice,String}Header value can
  only be created by converting from an unsafe.Pointer.

Well, almost only. There are still tricks that can be played to
workaround both of these. For example, a pointer can be dereferenced
via reflection, or a user could write a conversion like:

    type T reflect.SliceHeader
    _ = (*reflect.SliceHeader)(&T{})

But presumably this at least raises the bar enough that someone is
likely to pause to figure out the correct way to use
reflect.{Slice,String}Header.

Notably, disallowing *x and &x does *not* emit warnings for code that
uses reflect.{Slice,String}Header purely as values. For example, the
tests in internal/unsafeheader. Such code is arguably still a
violation of the unsafe.Pointer safety rules ("reflect.SliceHeader and
reflect.StringHeader should be used [...] never as plain structs"),
but is benign.

Updates golang/go#40701.

Change-Id: Id21996bfee07acc0d927a525797dca344bc804d8
Reviewed-on: https://go-review.googlesource.com/c/tools/+/248192
Reviewed-by: Michael Matloob <matloob@golang.org>
Trust: Matthew Dempsky <mdempsky@google.com>