alexcrichton / alexcrichton/dlmalloc-rs

Soundness Bug in this crate

Open
#65 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
C
Stars
122
Forks
60
PR merge metrics
No merged PRs in 30d

Description

Hi there!

We scanned the most popular libraries on crates.io and found some memory safety bugs in this library.

## ::free_part

### PoC
```rust
// src/main.rs
use dlmalloc::{Allocator, Dlmalloc};

fn main() {
let d = Dlmalloc::new();
let sys = d.allocator();

// - ptr = null => violates ptr::add precondition in the mremap-failure fallback.
// - oldsize < newsize => causes usize underflow in `oldsize - newsize` in release.
let ptr = core::ptr::null_mut::();
let oldsize = 0usize;
let newsize = 1usize;

// This is a safe call (trait method is safe) that reaches internal unsafe code.
let _ = Allocator::free_part(sys, ptr, oldsize, newsize);
}
```

### Miri Output
```text
error: Undefined Behavior: in-bounds pointer arithmetic failed: attempting to offset pointer by 1 byte, but got null pointer
--> /home/ccuu/Desktop/llm-detector/experiments/cache/crates_src/dlmalloc/0.2.12/dlmalloc-0.2.12/src/unix.rs:60:26
|
60 | libc::munmap(ptr.add(newsize).cast(), oldsize - newsize) == 0
| ^^^^^^^^^^^^^^^^ Undefined Behavior occurred here
|
= help: this indicates a bug in the program: it performed an invalid operation, and caused Undefined Behavior
= help: see https://doc.rust-lang.org/nightly/reference/behavior-considered-undefined.html for further information
= note: BACKTRACE:
= note: inside `::free_part` at /home/ccuu/Desktop/llm-detector/experiments/cache/crates_src/dlmalloc/0.2.12/dlmalloc-0.2.12/src/unix.rs:60:26: 60:42
note: inside `main`
--> src/main.rs:22:13
|
22 | let _ = Allocator::free_part(sys, ptr, oldsize, newsize);
| ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

note: some details are omitted, run with `MIRIFLAGS=-Zmiri-backtrace=full` for a verbose backtrace

error: aborting due to 1 previous error
```

We appreciate your work on this crate and hope this report helps improve its safety.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.