endoli / endoli/javascriptcore.rs
Unsoundness: `JSValue` (and others) can outlive the `Context`
- Lingua principale
- Rust
- Stelle
- 54
- Fork
- 4
- Metriche di merge delle PR
- Nessuna PR unita negli ultimi 30g
Descrizione
Hi,
`JSValue`, `JSObject` and others are not restricted in the lifetime, therefore are able to outlive the `Context`, in the best case just crashing the program and in the worst case causing a use-after-free.
The following script reproduces the problem and leads to a segfault (due to an safety check in jsc itself):
```rs
use javascriptcore::*;
fn main() {
let v;
{
let ctx = JSContext::default();
v = evaluate_script(&ctx, "'Hello' + ' ' + 'World'", None, "test.js", 1)
.expect("Failed to evaluate script");
println!("Value: {:?}", v.as_string());
}
println!("Value: {:?}", v.as_string());
}
```
Typically, you would add `PhantomData` to add a phantom lifetime. However, you already hold a raw pointer to the context in these structs and the context should be a widespread object in many real-world users of your bindings, ref-counting the context in Rust with `Arc` might be the best option.
Kind Regards
Tim
Guida per i contributori
Nessuna guida per i contributori indicizzata per questo repository
Valutazione
Questa issue non è ancora stata valutata.