zkVM args and env length can overflow
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 119k
- Forks
- 16.1k
- PR merge metrics
- PR metrics pending
Description
A large byte length can overflow to zero and still be used as the slice length.
That's targeting riscv32im-risc0-zkvm-elf where the implementations of std::env::args_os() and std::env::var_os() trust the host length. The code can allocate zero words and then build a huge
slice from that pointer.
Ideally we should panic instead of overflowing to avoid any huge allocation
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading library/std/src/sys/env/zkvm.rs and library/std/src/sys/args/zkvm.rs at the referenced length-handling lines. Trace how the host-provided lengths become allocations and slices, then verify that oversized lengths no longer wrap and instead cause a panic without a huge allocation.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- operating-systems
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 78/100