Comment by 1718627440

So Q is a "tuple-struct". In rust you can define a struct like

struct Q<T> { value: Option<T> }

with a named field or you can define it like

struct<T> Q(Some<T>)

which is the same struct layout but without an explicit name for the value. In that case, the field is implicitly names `0`

So q.0 = Some(foo) is equivalent to q.value = Some(foo).

The Some(..) is just one variant of the Option enum:

enum Option<T> { None, Some(T) }

Option represents a value that may or may not be initialized. For uninitialized values you use the None variant and then you can initialize it to Some(value).

The C rough equivalent would be

struct Q { void* value; }

struct Q q = q { NULL }; q->value = ...

Some(...) is just constructor for an option type as seen in other languages e.g. java's Optional, haskell's Maybe, c++'s std::optional. I assume that it's needed here because the field can't start as a null pointer otherwise. Maybe the vulnerability still works if the field starts with one string value and swaps to a different string value, but having it start holding None made for a simpler demo.

q.0 is the first field of q, which is anonymous. They could have just as well called it x and written q.x.

"Some(...)" means that this Option<T> does have a value of type T in it; "None" means it doesn't.

"q.0" is not really needed, it's a struct with unnamed fields. Here is the same with named fields:

  struct Q<T: 'static> { pub x: Option<T> }
  ...
  let l = String::new();
  let mut q = Q { x: None };
  q.x = Some(&l);