alexcrichton / alexcrichton/dlmalloc-rs
Soundness Bug in this crate
- Dominant language
- C
- Stars
- 122
- Forks
- 60
- PR merge metrics
- No merged PRs in 30d
Description
Hi there!
We scanned the most popular libraries on crates.io and found some memory safety bugs in this library.
## ::free_part
### PoC
```rust
// src/main.rs
use dlmalloc::{Allocator, Dlmalloc};
fn main() {
let d = Dlmalloc::new();
let sys = d.allocator();
// - ptr = null => violates ptr::add precondition in the mremap-failure fallback.
// - oldsize < newsize => causes usize underflow in `oldsize - newsize` in release.
let ptr = core::ptr::null_mut::();
let oldsize = 0usize;
let newsize = 1usize;
// This is a safe call (trait method is safe) that reaches internal unsafe code.
let _ = Allocator::free_part(sys, ptr, oldsize, newsize);
}
```
### Miri Output
```text
error: Undefined Behavior: in-bounds pointer arithmetic failed: attempting to offset pointer by 1 byte, but got null pointer
--> /home/ccuu/Desktop/llm-detector/experiments/cache/crates_src/dlmalloc/0.2.12/dlmalloc-0.2.12/src/unix.rs:60:26
|
60 | libc::munmap(ptr.add(newsize).cast(), oldsize - newsize) == 0
| ^^^^^^^^^^^^^^^^ Undefined Behavior occurred here
|
= help: this indicates a bug in the program: it performed an invalid operation, and caused Undefined Behavior
= help: see https://doc.rust-lang.org/nightly/reference/behavior-considered-undefined.html for further information
= note: BACKTRACE:
= note: inside `::free_part` at /home/ccuu/Desktop/llm-detector/experiments/cache/crates_src/dlmalloc/0.2.12/dlmalloc-0.2.12/src/unix.rs:60:26: 60:42
note: inside `main`
--> src/main.rs:22:13
|
22 | let _ = Allocator::free_part(sys, ptr, oldsize, newsize);
| ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
note: some details are omitted, run with `MIRIFLAGS=-Zmiri-backtrace=full` for a verbose backtrace
error: aborting due to 1 previous error
```
We appreciate your work on this crate and hope this report helps improve its safety.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.