endoli / endoli/javascriptcore.rs

Unsoundness: `JSValue` (and others) can outlive the `Context`

Open
#38 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Rust
Stars
54
Forks
4
PR merge metrics
No merged PRs in 30d

Description

Hi,

`JSValue`, `JSObject` and others are not restricted in the lifetime, therefore are able to outlive the `Context`, in the best case just crashing the program and in the worst case causing a use-after-free.

The following script reproduces the problem and leads to a segfault (due to an safety check in jsc itself):
```rs
use javascriptcore::*;

fn main() {
let v;
{
let ctx = JSContext::default();
v = evaluate_script(&ctx, "'Hello' + ' ' + 'World'", None, "test.js", 1)
.expect("Failed to evaluate script");
println!("Value: {:?}", v.as_string());
}
println!("Value: {:?}", v.as_string());
}
```

Typically, you would add `PhantomData` to add a phantom lifetime. However, you already hold a raw pointer to the context in these structs and the context should be a widespread object in many real-world users of your bindings, ref-counting the context in Rust with `Arc` might be the best option.

Kind Regards
Tim

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.