MegEngine / MegEngine/MegFlow

Maybe unsound in store

Open
#87 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
Rust
Stars
402
Forks
37
PR merge metrics
No merged PRs in 30d

Description

Hello, thank you for your contribution in this project. I am scanning the unsound problem in rust project and I notice the following code.
```
pub fn store(ts: *mut ffi::PyThreadState) -> PyThreadStateUnlimited {
match VERSION.1 {
6 => {
let ts = ts as *mut PyThreadStateUnlimited3_6;
unsafe {
let unlimited = PyThreadStateUnlimited {
frame: (*ts).frame,
recursion_depth: (*ts).recursion_depth,
exc_type: (*ts).exc_type,
exc_value: (*ts).exc_value,
exc_traceback: (*ts).exc_traceback,
..Default::default()
};
(*ts).frame = std::ptr::null_mut();
(*ts).recursion_depth = 0;
(*ts).exc_type = std::ptr::null_mut();
(*ts).exc_value = std::ptr::null_mut();
(*ts).exc_traceback = std::ptr::null_mut();
unlimited
}
}
...................................
```
consider this is a pub fn and loader is a pub mod, I assume the user can direct call the store function. If the user pass a eg. null pointer to ts, it will lead to a UB in rust.

Contributor guide

No contributing guide indexed for this repository

Research direction

The issue points to the public loader::store function and its unsafe access to ts; start by locating that entry point and tracing its callers and pointer invariants. Confirm the null-pointer behavior, then add the relevant regression coverage or establish the required API contract so invalid pointers cannot reach the unsafe access.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
28/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.