Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Multiple unsound issue #54

Open
lwz23 opened this issue Feb 28, 2025 · 0 comments
Open

Multiple unsound issue #54

lwz23 opened this issue Feb 28, 2025 · 0 comments

Comments

@lwz23
Copy link

lwz23 commented Feb 28, 2025

Hello,

Thank you for your work on this project. While auditing Rust code for memory safety issues, I discovered a potential soundness problem in the facade module.

considering the following code:

fn handle_from_ext(handle: u64) -> &'static Handle {
        let handle_ptr = handle as *mut Handle;
        unsafe { &*handle_ptr }
    }

Although this is a private fn, I notice there are multiple pub fn that can flow into this function.
pub fn as_currency -> fn handle_from_ext
pub fn as_error -> fn handle_from_ext
pub fn as_pricer_factory -> fn handle_from_ext
pub fn clone_handle -> fn handle_from_ext
pub fn as_market_data -> fn handle_from_ext
pub fn as_fixing_table -> fn handle_from_ext
pub fn as_report_generator -> fn handle_from_ext
pub fn as_instrument -> fn handle_from_ext
pub fn is_error -> fn handle_from_ext

I believe it cause UB and my PoC is below(For convenience, I've just mimicked the handle implementation without actually importing it, but that should make the point).

##Result

error: Undefined Behavior: constructing invalid value: encountered a dangling reference (use-after-free)
  --> src\main.rs:33:9
   |
33 |         static_ref
   |         ^^^^^^^^^^ constructing invalid value: encountered a dangling reference (use-after-free)
   |
   = help: this indicates a bug in the program: it performed an invalid operation, and caused Undefined Behavior
   = help: see https://doc.rust-lang.org/nightly/reference/behavior-considered-undefined.html for further information        
   = note: BACKTRACE:
   = note: inside `main` at src\main.rs:33:9: 33:19

note: some details are omitted, run with `MIRIFLAGS=-Zmiri-backtrace=full` for a verbose backtrace

error: aborting due to 1 previous error; 3 warnings emitted

error: process didn't exit successfully: `C:\Users\ROG\.rustup\toolchains\nightly-x86_64-pc-windows-msvc\bin\cargo-miri.exe runner target\miri\x86_64-pc-windows-msvc\debug\lwz.exe` (exit code: 1)
PS E:\Github\lwz> 
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant