paritytech / paritytech/parity-scale-codec
Unsound `read_vec_from_u8s()`
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 287
- Forks
- 103
- Avg merge
- 6d 13h
- Merged PRs (30d)
- 1
Description
Input::read() is a safe method of a safe trait, it doesn't guarantee an invariant of not reading its argument. So it is possible to have a perfectly safe implementation of Input that reads some bytes before writing to them, but since they are uninitialized (you just blindly called Vec::set_len()), it is an instant undefined behavior!
The right thing to do is to have a separate unsafe method that takes a pointer or add a method that takes something like &mut [MaybeUninit<T>] instead.
Originally posted by @nazar-pc in https://github.com/paritytech/parity-scale-codec/pull/605#discussion_r2076151291
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing read_vec_from_u8s() and the safe Input::read() method to understand how the vector is sized before reading. Compare the proposed unsafe pointer-based method with using &mut [MaybeUninit], then define a safe API that does not permit reads from uninitialized bytes. Done means the unsound behavior is removed and the relevant codec behavior is covered by tests.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- backend-api-design
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100