Fix RUSTSEC-2026-0197: swap_columns/swap_elements trigger UB when indices alias

[haraldreingruber-dedalus]

Fixes #565.

Problem

Matrix2::swap_columns, Matrix3::swap_columns, Matrix4::swap_columns, and the corresponding swap_elements implementations all used:

unsafe { ptr::swap(&mut self[a], &mut self[b]) };

When a == b, this creates two mutable references (&mut self[a] and &mut self[b]) to the same memory location. This violates Rust's aliasing guarantees and constitutes undefined behaviour under Miri (Stacked Borrows), even though the call is made from safe Rust.

Additionally, even for distinct indices, ptr::swap(&mut self[a], &mut self[b]) is flagged by Miri: both calls go through IndexMut::index_mut(&mut self, …), so the second call creates a new unique reborrow of all of self, invalidating the tag from the first call — a Stacked Borrows violation even though the pointed-to bytes don't overlap.

The same class of bug existed in:

• Array::swap_elements in structure.rs (UB when i == j)
• Matrix{2,3,4}::swap_elements (UB when both indices share the same column, i.e. ac == bc), because two exclusive borrows of the same column vector are created simultaneously

Fix (this branch)

Since S: BaseFloat implies S: Copy, column vectors and scalar elements are Copy. All unsafe is removed and the swap is done via a temporary variable:

fn swap_columns(&mut self, a: usize, b: usize) {
    if a == b {
        return;
    }
    let tmp = self[a];
    self[a] = self[b];
    self[b] = tmp;
}

This is fully clean under Miri. An alternative, minimal fix using early-returns only (keeping ptr::swap for distinct indices) is available on branch fix-swap-columns-early-return — that branch resolves the originally reported aliasing UB but is still flagged by Miri (Stacked Borrows) for the distinct-index path.

Tests

Added tests in tests/matrix.rs covering all three matrix sizes for:

• swap_columns with equal indices (was UB, now no-op)
• swap_columns with distinct indices (correct swap still works)
• swap_elements with the same position (was UB, now no-op)
• swap_elements with the same column and different rows (was potentially UB, now correct)

Note

These tests verify correctness (the operations produce the right values) but they do not catch the soundness bug in a regular cargo test run. Because ptr::swap of a location with itself happens to leave the value unchanged, the value-equality assertions pass with or without the fix. The bug can only be reliably detected by running the tests under Miri (cargo +nightly miri test).

Feel free to remove the new tests if they don't seem valuable enough without Miri coverage in CI.

---

Note

This fix was developed with the assistance of GitHub Copilot. While investigating the reported swap_columns UB, similar aliasing issues were also found and fixed in Array::swap_elements and Matrix*::swap_elements (same-column case), which were not explicitly called out in the original issue.