endoli / endoli/javascriptcore.rs

Unsoundness: `JSValue` (and others) can outlive the `Context`

Offen
#38 0 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen
Vorherrschende Sprache
Rust
Sterne
54
Forks
4
PR-Merge-Kennzahlen
Keine gemergten PRs in 30 T.

Beschreibung

Hi,

`JSValue`, `JSObject` and others are not restricted in the lifetime, therefore are able to outlive the `Context`, in the best case just crashing the program and in the worst case causing a use-after-free.

The following script reproduces the problem and leads to a segfault (due to an safety check in jsc itself):
```rs
use javascriptcore::*;

fn main() {
let v;
{
let ctx = JSContext::default();
v = evaluate_script(&ctx, "'Hello' + ' ' + 'World'", None, "test.js", 1)
.expect("Failed to evaluate script");
println!("Value: {:?}", v.as_string());
}
println!("Value: {:?}", v.as_string());
}
```

Typically, you would add `PhantomData` to add a phantom lifetime. However, you already hold a raw pointer to the context in these structs and the context should be a widespread object in many real-world users of your bindings, ref-counting the context in Rust with `Arc` might be the best option.

Kind Regards
Tim

Beitragsleitfaden

Für dieses Repository ist kein Beitragsleitfaden indexiert

Bewertung

Dieses Issue wurde noch nicht bewertet.

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.