FractalFir / FractalFir/memory_pages
Unsound usages of unsafe implementation about c_void
- Dominant language
- Rust
- Stars
- 32
- Forks
- 2
- PR merge metrics
- No merged PRs in 30d
Description
Hi, I am scanning this crate in the latest version using my own static analyzer tool.
Unsafe pointer conversion is found at:
```rust
pub fn advise_use_soon(&mut self, used: usize) {
#[cfg(target_family = "unix")]
unsafe {
let ad_len = self.len.min(used);
const POSIX_MADV_WILLNEED: c_int = 3;
posix_madvise(self.ptr as *mut c_void, ad_len, POSIX_MADV_WILLNEED);
}
}
```
This unsound implementation would create memory issues such as overflow, underflow, or misalignment. The attacker can manipulate the argument `used` associated with the `c_void` pointer and its size argument with a large value, which can lead to an out-of-bounds memory access bug. The `c_void` pointer and its associated size argument are passed through the FFI (`posix_madvise`), which can further corrupt the C/C++ code.
This would cause [undefined behaviors](https://doc.rust-lang.org/reference/behavior-considered-undefined.html) in Rust. Adversaries can manipulate the associated size argument to cause memory safety bugs. I am reporting this issue for your attention.
Contributor guide
Assessment
This issue has not been assessed yet.