You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Hello 🦀 ,
while scanning crates.io, we (Rust group @sslab-gatech) have noticed a soundness/memory safety issue in this crate which allows safe Rust code to trigger undefined behavior.
Issue
It is possible to make ARefss contain a non-Send / non-Sync object,
since there is no Send Sync bound on V in the ARefss::map() function.
use std::cell::Cell;use std::sync::Arc;use reffers::aref::ARefss;#[derive(Debug,Clone,Copy)]enumRefOrInt<'a>{Ref(&'a u64),Int(u64),}staticX:u64 = 0;fnmain(){let arc_0 = Arc::new(ARefss::new(Arc::new(0)).map(|_| {// New item is totally unrelated to the previously stored item.// New item is allowed to be !Sync, !Send.Box::leak(Box::new(Cell::new(RefOrInt::Ref(&X))))// Box::leak(Box::new(std::rc::Rc::new(0)))}));let arc_child = Arc::clone(&arc_0);
std::thread::spawn(move || {let arc_child = arc_child;let smuggled_cell = arc_child.as_ref();loop{
smuggled_cell.set(RefOrInt::Int(0xdeadbeef));
smuggled_cell.set(RefOrInt::Ref(&X));}});loop{ifletRefOrInt::Ref(addr) = arc_0.get(){if addr as*const_asusize == 0xdeadbeef{// Due to the data race, obtaining Ref(0xdeadbeef) is possibleprintln!("Pointer is now: {:p}", addr);println!("Dereferencing addr will now segfault: {}",*addr);}}}}
Thank you for checking out this issue 🦀
The text was updated successfully, but these errors were encountered:
Hello 🦀 ,
while scanning crates.io, we (Rust group @sslab-gatech) have noticed a soundness/memory safety issue in this crate which allows safe Rust code to trigger undefined behavior.
Issue
It is possible to make
ARefss
contain a non-Send
/ non-Sync
object,since there is no
Send Sync
bound onV
in theARefss::map()
function.Proof of Concept
I wrote a short program that can trigger undefined behavior in safe Rust using this crate.
Test environment
reffers-0.6.0
rustc 1.47.0 (18bf6b4f0 2020-10-07)
release
mode.Error message from the program
Thank you for checking out this issue 🦀
The text was updated successfully, but these errors were encountered: