You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Hi there, we (Rust group @sslab-gatech) are scanning crates on crates.io for potential soundness bugs. We noticed a panic safety issue in the StackA::push_cloned function:
The self.push_inner function increases the length of the stack, but between the element being written and this increased length the val.clone() function is called which can leave the stack in a longer state but missing an element. Here's a simple demonstration of this issue:
#![forbid(unsafe_code)]use stack_dst::StackA;#[derive(Debug)]structDropDetector(u32);implDropforDropDetector{fndrop(&mutself){println!("Dropping {}",self.0);}}implCloneforDropDetector{fnclone(&self) -> Self{panic!("Panic in clone()")}}fnmain(){letmut stack = StackA::<[DropDetector],[usize;9]>::new();
stack.push_stable([DropDetector(1)], |p| p).unwrap();
stack.push_stable([DropDetector(2)], |p| p).unwrap();println!("Popping off second drop detector");let second_drop = stack.pop();println!("Pushing panicky-clone");
stack.push_cloned(&[DropDetector(3)]).unwrap();}
This outputs:
Popping off second drop detector
Dropping 2
Pushing panicky-clone
thread 'main' panicked at 'Panic in clone()', src/main.rs:29:31
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
Dropping 3
Dropping 2
Dropping 1
Return code 101
Notice that Dropping 2 is printed twice, indicating a double-free.
The text was updated successfully, but these errors were encountered:
Hi there, we (Rust group @sslab-gatech) are scanning crates on crates.io for potential soundness bugs. We noticed a panic safety issue in the
StackA::push_cloned
function:stack_dst-rs/src/stack.rs
Lines 153 to 161 in 807e9d4
The
self.push_inner
function increases the length of the stack, but between the element being written and this increased length theval.clone()
function is called which can leave the stack in a longer state but missing an element. Here's a simple demonstration of this issue:This outputs:
Notice that
Dropping 2
is printed twice, indicating a double-free.The text was updated successfully, but these errors were encountered: