Skip to content

Multiple unsound issue #54

Description

@lwz23

Hello,

Thank you for your work on this project. While auditing Rust code for memory safety issues, I discovered a potential soundness problem in the facade module.

considering the following code:

fn handle_from_ext(handle: u64) -> &'static Handle {
        let handle_ptr = handle as *mut Handle;
        unsafe { &*handle_ptr }
    }

Although this is a private fn, I notice there are multiple pub fn that can flow into this function.
pub fn as_currency -> fn handle_from_ext
pub fn as_error -> fn handle_from_ext
pub fn as_pricer_factory -> fn handle_from_ext
pub fn clone_handle -> fn handle_from_ext
pub fn as_market_data -> fn handle_from_ext
pub fn as_fixing_table -> fn handle_from_ext
pub fn as_report_generator -> fn handle_from_ext
pub fn as_instrument -> fn handle_from_ext
pub fn is_error -> fn handle_from_ext

I believe it cause UB and my PoC is below(For convenience, I've just mimicked the handle implementation without actually importing it, but that should make the point).

##Result

error: Undefined Behavior: constructing invalid value: encountered a dangling reference (use-after-free)
  --> src\main.rs:33:9
   |
33 |         static_ref
   |         ^^^^^^^^^^ constructing invalid value: encountered a dangling reference (use-after-free)
   |
   = help: this indicates a bug in the program: it performed an invalid operation, and caused Undefined Behavior
   = help: see https://doc.rust-lang.org/nightly/reference/behavior-considered-undefined.html for further information        
   = note: BACKTRACE:
   = note: inside `main` at src\main.rs:33:9: 33:19

note: some details are omitted, run with `MIRIFLAGS=-Zmiri-backtrace=full` for a verbose backtrace

error: aborting due to 1 previous error; 3 warnings emitted

error: process didn't exit successfully: `C:\Users\ROG\.rustup\toolchains\nightly-x86_64-pc-windows-msvc\bin\cargo-miri.exe runner target\miri\x86_64-pc-windows-msvc\debug\lwz.exe` (exit code: 1)
PS E:\Github\lwz> 

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions