async-rs / async-rs/futures-timer
Function `futures-timer/src/native/global/raw_drop`, `raw_wake`, `raw_clone`, and `raw_wake_by_ref` can trigger invalid memory reference
- Dominant language
- Rust
- Stars
- 219
- Forks
- 42
- PR merge metrics
- No merged PRs in 30d
Description
Hi, I'm developing a fuzzer to test the safe abstraction, and I found some memory issues when calling function `futures-timer/src/native/global/raw_drop`, `raw_wake`, `raw_clone`, and `raw_wake_by_ref`.
Below are some test cases:
```rust
// case1:
#[test]
fn test_raw_drop_ikeZT() {
let ptr: Vec<()> = vec![];
let _ = raw_drop(ptr.as_ptr());
}
// case2:
fn test_raw_wake_JvToH() {
let ptr: Vec<()> = vec![()];
let _ = raw_wake(ptr.as_ptr());
}
// case3:
fn test_raw_clone_dGcoO() {
let ptr: Vec<()> = vec![];
let _ = raw_clone(ptr.as_ptr());
}
//case4:
fn test_raw_wake_by_ref_9Jhw9() {
let ptr: Vec<()> = vec![];
let _ = raw_wake_by_ref(ptr.as_ptr());
}
```
The outputs are:
```
error: test failed, to rerun pass `-p futures-timer --lib`
Caused by:
process didn't exit successfully: `/Users/liuzixi/Documents/futures-timer/target/debug/deps/futures_timer-f3d22d0c7e0e06d3 'native::global::test_raw_drop_ikeZT' --exact --show-output` (signal: 11, SIGSEGV: invalid memory reference)
```
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by inspecting the implementations of raw_drop, raw_wake, raw_clone, and raw_wake_by_ref under futures-timer/src/native/global. Reproduce the four supplied cases with the futures-timer library tests and investigate the SIGSEGV reports. Done means these invalid-pointer inputs no longer trigger an invalid memory reference, with regression coverage for the reported cases.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100