rust-memory-safety-examples examples/use_after_free_prevention.rs: Code Companion¶

//! Use-after-free prevention example

use rust_memory_safety_examples::use_after_free;

fn main() {
    println!("=== Use-After-Free Prevention in Rust ===\n");

    // Each call delegates to library module functions
    println!("1. Ownership Prevents Use-After-Free");
    use_after_free::ownership_prevents_uaf();

    println!("\n2. Borrowing Prevents Dangling References");
    use_after_free::borrowing_prevents_dangling();

    println!("\n3. C vs Rust Comparison");
    use_after_free::compare_c_vs_rust();

    // Summary output reinforces educational goals
    println!("\n=== Key Takeaways ===");
    println!("✓ Rust's ownership system makes use-after-free impossible");
    println!("✓ Compile-time prevention - errors caught before execution");
    println!("✓ Lifetimes ensure references are always valid");
    println!("✓ No runtime overhead - zero-cost abstraction");
}

// What use-after-free looks like in C (CONCEPTUAL - this is unsafe code)
// 
// char* ptr = malloc(100);    // Allocate memory
// strcpy(ptr, "hello");       // Use memory
// free(ptr);                  // Free memory
// printf("%s", ptr);          // BUG: Use after free!
//                             // ptr still holds the address, but memory is gone

// The freed memory might:
// - Still contain "hello" (appears to work)
// - Contain garbage (crashes or wrong output)  
// - Be reallocated for something else (security vulnerability)

// How Rust's ownership prevents use-after-free
fn ownership_prevents_uaf() {
    let data = String::from("hello");  // data owns the String

    let moved_data = data;  // Ownership transfers to moved_data
                            // data is now invalid - compiler enforces this

    // println!("{}", data);  // COMPILE ERROR: value borrowed after move
    //                        // ^^^^^^ This line would not compile

    println!("{}", moved_data);  // Only the current owner can access
}   // moved_data goes out of scope, memory is freed
    // No dangling pointers possible - the only handle is gone

// Borrowing with lifetime enforcement
fn borrowing_prevents_dangling() {
    let reference: &String;  // Declare a reference (no value yet)

    {
        let data = String::from("temporary");
        // reference = &data;  // COMPILE ERROR: `data` does not live long enough
        //                     // The borrow would outlive the owner
    }   // data dropped here - if reference pointed to it, it would dangle

    // Correct approach: reference must not outlive referent
    let data = String::from("lives long enough");
    reference = &data;  // OK: data lives as long as reference needs
    println!("{}", reference);
}   // Both data and reference go out of scope together - safe

// The compiler error would look like:
// error[E0597]: `data` does not live long enough
//    |     reference = &data;
//    |                 ^^^^^ borrowed value does not live long enough
//    | }
//    | - `data` dropped here while still borrowed

// These print statements emphasize the compile-time nature
println!("✓ Compile-time prevention - errors caught before execution");
println!("✓ No runtime overhead - zero-cost abstraction");

// Comparison of safety approaches:
//
// | Approach          | When Detected | Runtime Cost | Coverage    |
// |-------------------|---------------|--------------|-------------|
// | AddressSanitizer  | Runtime       | 2-3x slower  | Tested paths|
// | Garbage Collection| Runtime       | GC pauses    | Complete    |
// | Rust Ownership    | Compile-time  | Zero         | Complete    |

// Mental model comparison

// C pointer: "I believe valid data lives here"
// - The compiler trusts you
// - No verification of belief
// - Undefined behavior if wrong

// Rust reference: "The compiler verified valid data lives here"  
// - The compiler proves correctness
// - Static analysis of all code paths
// - Won't compile if unverifiable

fn compare_c_vs_rust() {
    // In Rust, you cannot create an invalid reference in safe code

    let valid_ref: &i32;
    let owner = 42;
    valid_ref = &owner;  // Compiler verifies: owner lives long enough

    // There is no Rust equivalent to:
    //   int* ptr = (int*)0xDEADBEEF;  // C: trust me, this is valid
    //   *ptr = 42;                     // Undefined behavior

    println!("Reference always valid: {}", valid_ref);
}