PLSysSec / PLSysSec/cargo-scan
Tracking issue: resource exhaustion cases
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 47
- Forks
- 7
- PR merge metrics
- No merged PRs in 30d
Description
Tracking issues for crates causing exhaustion of resources (stack/memory/etc.) for the current binary.
See: 9518569a86bc3976395f27047e775d65f802da66, 83ddaecf7500d2ebbab277bad1875518ab3ec275
-
on top10:syncrash -
on top100: still investigatingidnaandfutures-utilstack overflows
Update (2024-08-27): All crates OK on top10 and top100.
Still seeing some crashes on top10000 crates, e.g.
$ cargo run --bin scan data/packages/tryhard
Finished `dev` profile [unoptimized + debuginfo] target(s) in 0.52s
Running `target/debug/scan data/packages/tryhard`
thread 'main' panicked at /Users/caleb/.cargo/registry/src/index.crates.io-6f17d22bba15001f/chalk-recursive-0.93.0/src/fixed_point/stack.rs:51:13:
overflow depth reached
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by running cargo run --bin scan data/packages/tryhard and reviewing the referenced commits and the chalk-recursive stack overflow at fixed_point/stack.rs:51. Investigate the remaining top10000-crate resource-exhaustion cases; done means the scanner no longer crashes on the identified cases and the affected scenarios are covered.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- devtools, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 28/100