Add new `function_casts_as_integer` lint #141470

GuillaumeGomez · 2025-05-23T20:38:37Z

The function_casts_as_integer lint detects cases where users cast a function pointer into an integer.

warn-by-default

Example

fn foo() {}
let x = foo as usize;

warning: casting a function into an integer implicitly
  --> $DIR/function_casts_as_integer.rs:9:17
   |
LL |     let x = foo as usize;
   |                 ^^^^^^^^
   |
help: add `fn() as usize`
   |
LL |     let x = foo as fn() as usize;
   |                 +++++++

Explanation

You should never cast a function directly into an integer but go through a cast as fn first to make it obvious what's going on. It also allows to prevent confusion with (associated) constants.

Related to #81686 and https://stackoverflow.com/questions/68701177/whats-the-meaning-of-casting-a-rust-enum-variant-to-a-numeric-data-type

Also Discussed here, reported as a CVE here and in firefox's bugzilla here.

r? @Urgau

compiler/rustc_lint/messages.ftl

rustbot · 2025-05-24T22:47:37Z

Some changes occurred in src/tools/clippy

cc @rust-lang/clippy

rustbot · 2025-05-27T14:12:39Z

The Miri subtree was changed

cc @rust-lang/miri

flip1995 · 2025-05-27T16:04:52Z

compiler/rustc_lint/src/function_cast_as_integer.rs

+    /// a cast as `fn` first to make it obvious what's going on. It also allows
+    /// to prevent confusion with (associated) constants.
+    pub FUNCTION_CASTS_AS_INTEGER,
+    Warn,


Clippy has a few lints for fn to integer casts. But they are all restriction or style lints in Clippy. Adding a warn-by-default lint about this to rustc might be a bit aggressive 🤔

I know, I implemented one myself. 😉 I think it highlights the fact that this is a big issue and that the compiler should warn about it and eventually even forbid this fn to integer cast (you need to cast to an fn pointer first).

But in any case, it's up to the lang team.

Agreed 👍 Just want to add this information as "prior art" for the lang team to make this decision. Even though it might've sounded like it, I'm not against adding this lint to rustc.

Clippy question: Do you think if this lint gets added to rustc, we can (partially) deprecate Clippy lints?

Hard to say. For example confusing_method_to_numeric_cast provides extra information about what (likely) went wrong. But with the current lint, they likely would already have seen the problem and fixed it. So by default I'd say yes. But we could eventually uplift part of them to add the extra context clippy has that this lint doesn't provide. Would make it much more interesting and even more useful.

Yeah, a partial uplift might be good then, should this be accepted.

bors · 2025-11-10T21:26:05Z

📌 Commit 66b4e93 has been approved by urgau

It is now in the queue for this repository.

…nteger, r=urgau Add new `function_casts_as_integer` lint The `function_casts_as_integer` lint detects cases where users cast a function pointer into an integer. *warn-by-default* ### Example ```rust fn foo() {} let x = foo as usize; ``` ``` warning: casting a function into an integer implicitly --> $DIR/function_casts_as_integer.rs:9:17 | LL | let x = foo as usize; | ^^^^^^^^ | help: add `fn() as usize` | LL | let x = foo as fn() as usize; | +++++++ ``` ### Explanation You should never cast a function directly into an integer but go through a cast as `fn` first to make it obvious what's going on. It also allows to prevent confusion with (associated) constants. Related to rust-lang#81686 and https://stackoverflow.com/questions/68701177/whats-the-meaning-of-casting-a-rust-enum-variant-to-a-numeric-data-type r? `@urgau`

…nteger, r=urgau Add new `function_casts_as_integer` lint The `function_casts_as_integer` lint detects cases where users cast a function pointer into an integer. *warn-by-default* ### Example ```rust fn foo() {} let x = foo as usize; ``` ``` warning: casting a function into an integer implicitly --> $DIR/function_casts_as_integer.rs:9:17 | LL | let x = foo as usize; | ^^^^^^^^ | help: add `fn() as usize` | LL | let x = foo as fn() as usize; | +++++++ ``` ### Explanation You should never cast a function directly into an integer but go through a cast as `fn` first to make it obvious what's going on. It also allows to prevent confusion with (associated) constants. Related to rust-lang#81686 and https://stackoverflow.com/questions/68701177/whats-the-meaning-of-casting-a-rust-enum-variant-to-a-numeric-data-type r? ``@urgau``

…nteger, r=urgau Add new `function_casts_as_integer` lint The `function_casts_as_integer` lint detects cases where users cast a function pointer into an integer. *warn-by-default* ### Example ```rust fn foo() {} let x = foo as usize; ``` ``` warning: casting a function into an integer implicitly --> $DIR/function_casts_as_integer.rs:9:17 | LL | let x = foo as usize; | ^^^^^^^^ | help: add `fn() as usize` | LL | let x = foo as fn() as usize; | +++++++ ``` ### Explanation You should never cast a function directly into an integer but go through a cast as `fn` first to make it obvious what's going on. It also allows to prevent confusion with (associated) constants. Related to rust-lang#81686 and https://stackoverflow.com/questions/68701177/whats-the-meaning-of-casting-a-rust-enum-variant-to-a-numeric-data-type r? ```@urgau```

Rollup of 16 pull requests Successful merges: - #141470 (Add new `function_casts_as_integer` lint) - #143619 (`c_variadic`: Add future-incompatibility warning for `...` arguments without a pattern outside of `extern` blocks) - #146495 (rustdoc: Erase `#![doc(document_private_items)]`) - #147771 (Rename `*exact_{div,shr,shl}` to `*{div,shr,shl}_exact`) - #147833 (rustdoc-json: move `target` to `json::conversions`) - #147952 (Add a timeout to the `remote-test-client` connection) - #147955 (compiletest: Migrate `TestProps` directive handling to a system of named handlers) - #148480 (Add `Steal::risky_hack_borrow_mut`) - #148506 (Special case detecting `'static` lifetime requirement coming from `-> Box<dyn Trait>`) - #148508 (Provide more context when mutably borrowing an imutably borrowed value) - #148530 (update the bootstrap readme) - #148608 (Add test for --test-builder success path) - #148636 (bootstrap: respect `build.python` on macOS) - #148639 (test(rustdoc): move tests into jump-to-def) - #148647 (Check unsafety for non-macro attributes in `validate_attr`) - #148667 (a few small clippy fixes) r? `@ghost` `@rustbot` modify labels: rollup

Rollup of 15 pull requests Successful merges: - #141470 (Add new `function_casts_as_integer` lint) - #143619 (`c_variadic`: Add future-incompatibility warning for `...` arguments without a pattern outside of `extern` blocks) - #146495 (rustdoc: Erase `#![doc(document_private_items)]`) - #147771 (Rename `*exact_{div,shr,shl}` to `*{div,shr,shl}_exact`) - #147833 (rustdoc-json: move `target` to `json::conversions`) - #147955 (compiletest: Migrate `TestProps` directive handling to a system of named handlers) - #148480 (Add `Steal::risky_hack_borrow_mut`) - #148506 (Special case detecting `'static` lifetime requirement coming from `-> Box<dyn Trait>`) - #148508 (Provide more context when mutably borrowing an imutably borrowed value) - #148530 (update the bootstrap readme) - #148608 (Add test for --test-builder success path) - #148636 (bootstrap: respect `build.python` on macOS) - #148639 (test(rustdoc): move tests into jump-to-def) - #148647 (Check unsafety for non-macro attributes in `validate_attr`) - #148667 (a few small clippy fixes) r? `@ghost` `@rustbot` modify labels: rollup

Rollup merge of #141470 - GuillaumeGomez:function_casts_as_integer, r=urgau Add new `function_casts_as_integer` lint The `function_casts_as_integer` lint detects cases where users cast a function pointer into an integer. *warn-by-default* ### Example ```rust fn foo() {} let x = foo as usize; ``` ``` warning: casting a function into an integer implicitly --> $DIR/function_casts_as_integer.rs:9:17 | LL | let x = foo as usize; | ^^^^^^^^ | help: add `fn() as usize` | LL | let x = foo as fn() as usize; | +++++++ ``` ### Explanation You should never cast a function directly into an integer but go through a cast as `fn` first to make it obvious what's going on. It also allows to prevent confusion with (associated) constants. Related to #81686 and https://stackoverflow.com/questions/68701177/whats-the-meaning-of-casting-a-rust-enum-variant-to-a-numeric-data-type r? ````@urgau````

Rollup of 15 pull requests Successful merges: - rust-lang/rust#141470 (Add new `function_casts_as_integer` lint) - rust-lang/rust#143619 (`c_variadic`: Add future-incompatibility warning for `...` arguments without a pattern outside of `extern` blocks) - rust-lang/rust#146495 (rustdoc: Erase `#![doc(document_private_items)]`) - rust-lang/rust#147771 (Rename `*exact_{div,shr,shl}` to `*{div,shr,shl}_exact`) - rust-lang/rust#147833 (rustdoc-json: move `target` to `json::conversions`) - rust-lang/rust#147955 (compiletest: Migrate `TestProps` directive handling to a system of named handlers) - rust-lang/rust#148480 (Add `Steal::risky_hack_borrow_mut`) - rust-lang/rust#148506 (Special case detecting `'static` lifetime requirement coming from `-> Box<dyn Trait>`) - rust-lang/rust#148508 (Provide more context when mutably borrowing an imutably borrowed value) - rust-lang/rust#148530 (update the bootstrap readme) - rust-lang/rust#148608 (Add test for --test-builder success path) - rust-lang/rust#148636 (bootstrap: respect `build.python` on macOS) - rust-lang/rust#148639 (test(rustdoc): move tests into jump-to-def) - rust-lang/rust#148647 (Check unsafety for non-macro attributes in `validate_attr`) - rust-lang/rust#148667 (a few small clippy fixes) r? `@ghost` `@rustbot` modify labels: rollup

RalfJung · 2025-11-12T07:02:16Z

src/tools/miri/src/shims/native_lib/trace/parent.rs


    // Move the instr ptr into the deprotection code.
-    #[expect(clippy::as_conversions)]
+    #[allow(unknown_lints)]


When you add things that are needed only for bootstraping, please mark them with cfg_attr(bootstrap) so that they don't unnecessarily stick around longer than they have to.

Wasn't sure it was used for tools outside compiler folder. Noted for next time.

RalfJung · 2025-11-12T07:08:31Z

src/tools/miri/tests/pass/backtrace/backtrace-api-v1.rs

@@ -1,5 +1,7 @@
 //@normalize-stderr-test: "::<.*>" -> ""

+#![allow(function_casts_as_integer)]


Why did you allow the lint here? I can't find an as-int cast in this file and on the playground the file seems fine even without the allow.

Introduced in rust-lang/rust#141470

…nteger, r=urgau Add new `function_casts_as_integer` lint The `function_casts_as_integer` lint detects cases where users cast a function pointer into an integer. *warn-by-default* ### Example ```rust fn foo() {} let x = foo as usize; ``` ``` warning: casting a function into an integer implicitly --> $DIR/function_casts_as_integer.rs:9:17 | LL | let x = foo as usize; | ^^^^^^^^ | help: add `fn() as usize` | LL | let x = foo as fn() as usize; | +++++++ ``` ### Explanation You should never cast a function directly into an integer but go through a cast as `fn` first to make it obvious what's going on. It also allows to prevent confusion with (associated) constants. Related to rust-lang#81686 and https://stackoverflow.com/questions/68701177/whats-the-meaning-of-casting-a-rust-enum-variant-to-a-numeric-data-type r? ````@urgau````

This MR contains the following updates: | Package | Update | Change | |---|---|---| | [rust](https://github.com/rust-lang/rust) | minor | `1.92.0` → `1.93.0` | MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot). **Proposed changes to behavior should be submitted there as MRs.** --- ### Release Notes <details> <summary>rust-lang/rust (rust)</summary> ### [`v1.93.0`](https://github.com/rust-lang/rust/blob/HEAD/RELEASES.md#Version-1930-2026-01-22) [Compare Source](rust-lang/rust@1.92.0...1.93.0) \========================== <a id="1.93.0-Language"></a> ## Language - [Stabilize several s390x `vector`-related target features and the `is_s390x_feature_detected!` macro](rust-lang/rust#145656) - [Stabilize declaration of C-style variadic functions for the `system` ABI](rust-lang/rust#145954) - [Emit error when using some keyword as a `cfg` predicate](rust-lang/rust#146978) - [Stabilize `asm_cfg`](rust-lang/rust#147736) - [During const-evaluation, support copying pointers byte-by-byte](rust-lang/rust#148259) - [LUB coercions now correctly handle function item types, and functions with differing safeties](rust-lang/rust#148602) - [Allow `const` items that contain mutable references to `static` (which is *very* unsafe, but not *always* UB)](rust-lang/rust#148746) - [Add warn-by-default `const_item_interior_mutations` lint to warn against calls which mutate interior mutable `const` items](rust-lang/rust#148407) - [Add warn-by-default `function_casts_as_integer` lint](rust-lang/rust#141470) <a id="1.93.0-Compiler"></a> ## Compiler - [Stabilize `-Cjump-tables=bool`](rust-lang/rust#145974). The flag was previously called `-Zno-jump-tables`. <a id="1.93.0-Platform-Support"></a> ## Platform Support - [Promote `riscv64a23-unknown-linux-gnu` to Tier 2 (without host tools)](rust-lang/rust#148435) Refer to Rust's [platform support page][platform-support-doc] for more information on Rust's tiered platform support. [platform-support-doc]: https://doc.rust-lang.org/rustc/platform-support.html <a id="1.93.0-Libraries"></a> ## Libraries - [Stop internally using `specialization` on the `Copy` trait as it is unsound in the presence of lifetime dependent `Copy` implementations. This may result in some performance regressions as some standard library APIs may now call `Clone::clone` instead of performing bitwise copies](rust-lang/rust#135634) - [Allow the global allocator to use thread-local storage and `std::thread::current()`](rust-lang/rust#144465) - [Make `BTree::append` not update existing keys when appending an entry which already exists](rust-lang/rust#145628) - [Don't require `T: RefUnwindSafe` for `vec::IntoIter<T>: UnwindSafe`](rust-lang/rust#145665) <a id="1.93.0-Stabilized-APIs"></a> ## Stabilized APIs - [`<[MaybeUninit<T>]>::assume_init_drop`](https://doc.rust-lang.org/stable/core/primitive.slice.html#method.assume_init_drop) - [`<[MaybeUninit<T>]>::assume_init_ref`](https://doc.rust-lang.org/stable/core/primitive.slice.html#method.assume_init_ref) - [`<[MaybeUninit<T>]>::assume_init_mut`](https://doc.rust-lang.org/stable/core/primitive.slice.html#method.assume_init_mut) - [`<[MaybeUninit<T>]>::write_copy_of_slice`](https://doc.rust-lang.org/stable/std/primitive.slice.html#method.write_copy_of_slice) - [`<[MaybeUninit<T>]>::write_clone_of_slice`](https://doc.rust-lang.org/stable/std/primitive.slice.html#method.write_clone_of_slice) - [`String::into_raw_parts`](https://doc.rust-lang.org/stable/std/string/struct.String.html#method.into_raw_parts) - [`Vec::into_raw_parts`](https://doc.rust-lang.org/stable/std/vec/struct.Vec.html#method.into_raw_parts) - [`<iN>::unchecked_neg`](https://doc.rust-lang.org/stable/std/primitive.isize.html#method.unchecked_neg) - [`<iN>::unchecked_shl`](https://doc.rust-lang.org/stable/std/primitive.isize.html#method.unchecked_shl) - [`<iN>::unchecked_shr`](https://doc.rust-lang.org/stable/std/primitive.isize.html#method.unchecked_shr) - [`<uN>::unchecked_shl`](https://doc.rust-lang.org/stable/std/primitive.usize.html#method.unchecked_shl) - [`<uN>::unchecked_shr`](https://doc.rust-lang.org/stable/std/primitive.usize.html#method.unchecked_shr) - [`<[T]>::as_array`](https://doc.rust-lang.org/stable/std/primitive.slice.html#method.as_array) - [`<[T]>::as_array_mut`](https://doc.rust-lang.org/stable/std/primitive.slice.html#method.as_mut_array) - [`<*const [T]>::as_array`](https://doc.rust-lang.org/stable/std/primitive.pointer.html#method.as_array) - [`<*mut [T]>::as_array_mut`](https://doc.rust-lang.org/stable/std/primitive.pointer.html#method.as_mut_array) - [`VecDeque::pop_front_if`](https://doc.rust-lang.org/stable/std/collections/struct.VecDeque.html#method.pop_front_if) - [`VecDeque::pop_back_if`](https://doc.rust-lang.org/stable/std/collections/struct.VecDeque.html#method.pop_back_if) - [`Duration::from_nanos_u128`](https://doc.rust-lang.org/stable/std/time/struct.Duration.html#method.from_nanos_u128) - [`char::MAX_LEN_UTF8`](https://doc.rust-lang.org/stable/std/primitive.char.html#associatedconstant.MAX_LEN_UTF8) - [`char::MAX_LEN_UTF16`](https://doc.rust-lang.org/stable/std/primitive.char.html#associatedconstant.MAX_LEN_UTF16) - [`std::fmt::from_fn`](https://doc.rust-lang.org/stable/std/fmt/fn.from_fn.html) - [`std::fmt::FromFn`](https://doc.rust-lang.org/stable/std/fmt/struct.FromFn.html) <a id="1.93.0-Cargo"></a> ## Cargo - [Enable CARGO\_CFG\_DEBUG\_ASSERTIONS in build scripts based on profile](rust-lang/cargo#16160) - [In `cargo tree`, support long forms for `--format` variables](rust-lang/cargo#16204) - [Add `--workspace` to `cargo clean`](rust-lang/cargo#16263) <a id="1.93.0-Rustdoc"></a> ## Rustdoc - [Remove `#![doc(document_private_items)]`](rust-lang/rust#146495) - [Include attribute and derive macros in search filters for "macros"](rust-lang/rust#148176) - [Include extern crates in search filters for `import`](rust-lang/rust#148301) - [Validate usage of crate-level doc attributes](rust-lang/rust#149197). This means if any of `html_favicon_url`, `html_logo_url`, `html_playground_url`, `issue_tracker_base_url`, or `html_no_source` either has a missing value, an unexpected value, or a value of the wrong type, rustdoc will emit the deny-by-default lint `rustdoc::invalid_doc_attributes`. <a id="1.93.0-Compatibility-Notes"></a> ## Compatibility Notes - [Introduce `pin_v2` into the builtin attributes namespace](rust-lang/rust#139751) - [Update bundled musl to 1.2.5](rust-lang/rust#142682) - [On Emscripten, the unwinding ABI used when compiling with `panic=unwind` was changed from the JS exception handling ABI to the wasm exception handling ABI.](rust-lang/rust#147224) If linking C/C++ object files with Rust objects, `-fwasm-exceptions` must be passed to the linker now. On nightly Rust, it is possible to get the old behavior with `-Zwasm-emscripten-eh=false -Zbuild-std`, but it will be removed in a future release. - The `#[test]` attribute, used to define tests, was previously ignored in various places where it had no meaning (e.g on trait methods or types). Putting the `#[test]` attribute in these places is no longer ignored, and will now result in an error; this may also result in errors when generating rustdoc. [Error when `test` attribute is applied to structs](rust-lang/rust#147841) - Cargo now sets the `CARGO_CFG_DEBUG_ASSERTIONS` environment variable in more situations. This will cause crates depending on `static-init` versions 1.0.1 to 1.0.3 to fail compilation with "failed to resolve: use of unresolved module or unlinked crate `parking_lot`". See [the linked issue](rust-lang/rust#150646 (comment)) for details. - [User written types in the `offset_of!` macro are now checked to be well formed.](rust-lang/rust#150465) - `cargo publish` no longer emits `.crate` files as a final artifact for user access when the `build.build-dir` config is unset - [Upgrade the `deref_nullptr` lint from warn-by-default to deny-by-default](rust-lang/rust#148122) - [Add future-incompatibility warning for `...` function parameters without a pattern outside of `extern` blocks](rust-lang/rust#143619) - [Introduce future-compatibility warning for `repr(C)` enums whose discriminant values do not fit into a `c_int` or `c_uint`](rust-lang/rust#147017) - [Introduce future-compatibility warning against ignoring `repr(C)` types as part of `repr(transparent)`](rust-lang/rust#147185) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this MR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this MR, check this box --- This MR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).

rustbot assigned Urgau May 23, 2025