zeroize: possible UB in `Zeroize` implementation for `Option<T>`
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 674
- Forks
- 170
- Avg merge
- 1d 12h
- Merged PRs (30d)
- 10
Description
Originally filed by @jessa0 as https://github.com/iqlusioninc/crates/issues/782:
It seems the
Zeroizeimplementation forOption<T> where T: Zeroizehas language-level UB here:I believe, as a
repr(Rust)enum, the memory layout and set of valid bit-patterns forOptionis not defined, and that setting an enum's storage to an invalid bit-pattern while a reference to it exists, even if the value is never read, is instant language-level UB. The documentation forOptiondoes mention guarantees for several special cases, but theNonecase still isn't defined for many of those cases, and theZeroizeimplementation is more generic than that. Here's an example of a miri error in such a situation, that scottmcm came up with on URLO here.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with zeroize/src/lib.rs around line 330 and reproduce the reported behavior using the linked Rust Playground or Miri example. Determine a sound approach for the Option implementation and verify that the resulting behavior no longer triggers the reported undefined-behavior error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100