endoli / endoli/javascriptcore.rs

Unsoundness: `JSValue` (and others) can outlive the `Context`

Aperta
#38 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub
Lingua principale
Rust
Stelle
54
Fork
4
Metriche di merge delle PR
Nessuna PR unita negli ultimi 30g

Descrizione

Hi,

`JSValue`, `JSObject` and others are not restricted in the lifetime, therefore are able to outlive the `Context`, in the best case just crashing the program and in the worst case causing a use-after-free.

The following script reproduces the problem and leads to a segfault (due to an safety check in jsc itself):
```rs
use javascriptcore::*;

fn main() {
let v;
{
let ctx = JSContext::default();
v = evaluate_script(&ctx, "'Hello' + ' ' + 'World'", None, "test.js", 1)
.expect("Failed to evaluate script");
println!("Value: {:?}", v.as_string());
}
println!("Value: {:?}", v.as_string());
}
```

Typically, you would add `PhantomData` to add a phantom lifetime. However, you already hold a raw pointer to the context in these structs and the context should be a widespread object in many real-world users of your bindings, ref-counting the context in Rust with `Arc` might be the best option.

Kind Regards
Tim

Guida per i contributori

Nessuna guida per i contributori indicizzata per questo repository

Valutazione

Questa issue non è ancora stata valutata.

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.