async-rs / async-rs/futures-timer

Unsound usages of unsafe implementation from `()` to `Thread`

Open
#76 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Rust
Stars
219
Forks
42
PR merge metrics
No merged PRs in 30d

Description

Hi, I am scanning the futures-timer in the latest version with my own static analyzer tool.

Unsafe conversion found at: src/native/global.rs#L86
``` rust
fn raw_clone(ptr: *const ()) -> RawWaker {
let me = ManuallyDrop::new(unsafe { Arc::from_raw(ptr as *const Thread) });
mem::forget(me.clone());
RawWaker::new(ptr, &VTABLE)
}
```

This unsound implementation would create a misalignment issues if the type size of `()` is smaller than the type size of `Thread`.

This would potentially cause [undefined behaviors](https://doc.rust-lang.org/reference/behavior-considered-undefined.html) in Rust. If we further manipulate the problematic converted types, it would potentially lead to different consequences such as access out-of-bound. I am reporting this issue for your attention.

Contributor guide

No contributing guide indexed for this repository

Research direction

Inspect src/native/global.rs at line 86, starting with raw_clone and its RawWaker, Arc, and Thread types. Run the project's Rust tests and verify that the unsafe conversion no longer permits invalid alignment or undefined behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.