You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Thank you for your work on this project. While auditing Rust code for memory safety issues, I discovered a potential soundness problem in the facade module.
considering the following code:
fn handle_from_ext(handle: u64) -> &'static Handle {
let handle_ptr = handle as *mut Handle;
unsafe { &*handle_ptr }
}
Although this is a private fn, I notice there are multiple pub fn that can flow into this function.
pub fn as_currency -> fn handle_from_ext
pub fn as_error -> fn handle_from_ext
pub fn as_pricer_factory -> fn handle_from_ext
pub fn clone_handle -> fn handle_from_ext
pub fn as_market_data -> fn handle_from_ext
pub fn as_fixing_table -> fn handle_from_ext
pub fn as_report_generator -> fn handle_from_ext
pub fn as_instrument -> fn handle_from_ext
pub fn is_error -> fn handle_from_ext
I believe it cause UB and my PoC is below(For convenience, I've just mimicked the handle implementation without actually importing it, but that should make the point).
##Result
error: Undefined Behavior: constructing invalid value: encountered a dangling reference (use-after-free)
--> src\main.rs:33:9
|
33 | static_ref
| ^^^^^^^^^^ constructing invalid value: encountered a dangling reference (use-after-free)
|
= help: this indicates a bug in the program: it performed an invalid operation, and caused Undefined Behavior
= help: see https://doc.rust-lang.org/nightly/reference/behavior-considered-undefined.html for further information
= note: BACKTRACE:
= note: inside `main` at src\main.rs:33:9: 33:19
note: some details are omitted, run with `MIRIFLAGS=-Zmiri-backtrace=full` for a verbose backtrace
error: aborting due to 1 previous error; 3 warnings emitted
error: process didn't exit successfully: `C:\Users\ROG\.rustup\toolchains\nightly-x86_64-pc-windows-msvc\bin\cargo-miri.exe runner target\miri\x86_64-pc-windows-msvc\debug\lwz.exe` (exit code: 1)
PS E:\Github\lwz>
The text was updated successfully, but these errors were encountered:
Hello,
Thank you for your work on this project. While auditing Rust code for memory safety issues, I discovered a potential soundness problem in the facade module.
considering the following code:
Although this is a private fn, I notice there are multiple pub fn that can flow into this function.
pub fn as_currency -> fn handle_from_ext
pub fn as_error -> fn handle_from_ext
pub fn as_pricer_factory -> fn handle_from_ext
pub fn clone_handle -> fn handle_from_ext
pub fn as_market_data -> fn handle_from_ext
pub fn as_fixing_table -> fn handle_from_ext
pub fn as_report_generator -> fn handle_from_ext
pub fn as_instrument -> fn handle_from_ext
pub fn is_error -> fn handle_from_ext
I believe it cause UB and my PoC is below(For convenience, I've just mimicked the handle implementation without actually importing it, but that should make the point).
##Result
The text was updated successfully, but these errors were encountered: