FractalFir / FractalFir/memory_pages

Unsound usages of unsafe implementation about c_void

Open
#2 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Rust
Stars
32
Forks
2
PR merge metrics
No merged PRs in 30d

Description

Hi, I am scanning this crate in the latest version using my own static analyzer tool.

Unsafe pointer conversion is found at:

```rust
pub fn advise_use_soon(&mut self, used: usize) {
#[cfg(target_family = "unix")]
unsafe {
let ad_len = self.len.min(used);
const POSIX_MADV_WILLNEED: c_int = 3;
posix_madvise(self.ptr as *mut c_void, ad_len, POSIX_MADV_WILLNEED);
}
}
```

This unsound implementation would create memory issues such as overflow, underflow, or misalignment. The attacker can manipulate the argument `used` associated with the `c_void` pointer and its size argument with a large value, which can lead to an out-of-bounds memory access bug. The `c_void` pointer and its associated size argument are passed through the FFI (`posix_madvise`), which can further corrupt the C/C++ code.

This would cause [undefined behaviors](https://doc.rust-lang.org/reference/behavior-considered-undefined.html) in Rust. Adversaries can manipulate the associated size argument to cause memory safety bugs. I am reporting this issue for your attention.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.