async-rs / async-rs/futures-timer

Function `futures-timer/src/native/global/raw_drop`, `raw_wake`, `raw_clone`, and `raw_wake_by_ref` can trigger invalid memory reference

Open
#80 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Rust
Stars
219
Forks
42
PR merge metrics
No merged PRs in 30d

Description

Hi, I'm developing a fuzzer to test the safe abstraction, and I found some memory issues when calling function `futures-timer/src/native/global/raw_drop`, `raw_wake`, `raw_clone`, and `raw_wake_by_ref`.

Below are some test cases:
```rust
// case1:
#[test]
fn test_raw_drop_ikeZT() {
let ptr: Vec<()> = vec![];
let _ = raw_drop(ptr.as_ptr());
}

// case2:
fn test_raw_wake_JvToH() {
let ptr: Vec<()> = vec![()];
let _ = raw_wake(ptr.as_ptr());
}

// case3:
fn test_raw_clone_dGcoO() {
let ptr: Vec<()> = vec![];
let _ = raw_clone(ptr.as_ptr());
}

//case4:
fn test_raw_wake_by_ref_9Jhw9() {
let ptr: Vec<()> = vec![];
let _ = raw_wake_by_ref(ptr.as_ptr());
}
```

The outputs are:
```
error: test failed, to rerun pass `-p futures-timer --lib`

Caused by:
process didn't exit successfully: `/Users/liuzixi/Documents/futures-timer/target/debug/deps/futures_timer-f3d22d0c7e0e06d3 'native::global::test_raw_drop_ikeZT' --exact --show-output` (signal: 11, SIGSEGV: invalid memory reference)
```

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by inspecting the implementations of raw_drop, raw_wake, raw_clone, and raw_wake_by_ref under futures-timer/src/native/global. Reproduce the four supplied cases with the futures-timer library tests and investigate the SIGSEGV reports. Done means these invalid-pointer inputs no longer trigger an invalid memory reference, with regression coverage for the reported cases.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.