async-rs / async-rs/futures-timer
Unsound usages of unsafe implementation from `()` to `Thread`
- Dominant language
- Rust
- Stars
- 219
- Forks
- 42
- PR merge metrics
- No merged PRs in 30d
Description
Hi, I am scanning the futures-timer in the latest version with my own static analyzer tool.
Unsafe conversion found at: src/native/global.rs#L86
``` rust
fn raw_clone(ptr: *const ()) -> RawWaker {
let me = ManuallyDrop::new(unsafe { Arc::from_raw(ptr as *const Thread) });
mem::forget(me.clone());
RawWaker::new(ptr, &VTABLE)
}
```
This unsound implementation would create a misalignment issues if the type size of `()` is smaller than the type size of `Thread`.
This would potentially cause [undefined behaviors](https://doc.rust-lang.org/reference/behavior-considered-undefined.html) in Rust. If we further manipulate the problematic converted types, it would potentially lead to different consequences such as access out-of-bound. I am reporting this issue for your attention.
Contributor guide
No contributing guide indexed for this repository
Research direction
Inspect src/native/global.rs at line 86, starting with raw_clone and its RawWaker, Arc, and Thread types. Run the project's Rust tests and verify that the unsafe conversion no longer permits invalid alignment or undefined behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100