Maybe unsound in store
- Dominant language
- Rust
- Stars
- 402
- Forks
- 37
- PR merge metrics
- No merged PRs in 30d
Description
Hello, thank you for your contribution in this project. I am scanning the unsound problem in rust project and I notice the following code.
```
pub fn store(ts: *mut ffi::PyThreadState) -> PyThreadStateUnlimited {
match VERSION.1 {
6 => {
let ts = ts as *mut PyThreadStateUnlimited3_6;
unsafe {
let unlimited = PyThreadStateUnlimited {
frame: (*ts).frame,
recursion_depth: (*ts).recursion_depth,
exc_type: (*ts).exc_type,
exc_value: (*ts).exc_value,
exc_traceback: (*ts).exc_traceback,
..Default::default()
};
(*ts).frame = std::ptr::null_mut();
(*ts).recursion_depth = 0;
(*ts).exc_type = std::ptr::null_mut();
(*ts).exc_value = std::ptr::null_mut();
(*ts).exc_traceback = std::ptr::null_mut();
unlimited
}
}
...................................
```
consider this is a pub fn and loader is a pub mod, I assume the user can direct call the store function. If the user pass a eg. null pointer to ts, it will lead to a UB in rust.
Contributor guide
No contributing guide indexed for this repository
Research direction
The issue points to the public loader::store function and its unsafe access to ts; start by locating that entry point and tracing its callers and pointer invariants. Confirm the null-pointer behavior, then add the relevant regression coverage or establish the required API contract so invalid pointers cannot reach the unsafe access.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 28/100