-
Notifications
You must be signed in to change notification settings - Fork 46
Description
Hello,
Thank you for your work on this project. While auditing Rust code for memory safety issues, I discovered a potential soundness problem in the facade module.
considering the following code:
fn handle_from_ext(handle: u64) -> &'static Handle {
let handle_ptr = handle as *mut Handle;
unsafe { &*handle_ptr }
}
Although this is a private fn, I notice there are multiple pub fn that can flow into this function.
pub fn as_currency -> fn handle_from_ext
pub fn as_error -> fn handle_from_ext
pub fn as_pricer_factory -> fn handle_from_ext
pub fn clone_handle -> fn handle_from_ext
pub fn as_market_data -> fn handle_from_ext
pub fn as_fixing_table -> fn handle_from_ext
pub fn as_report_generator -> fn handle_from_ext
pub fn as_instrument -> fn handle_from_ext
pub fn is_error -> fn handle_from_ext
I believe it cause UB and my PoC is below(For convenience, I've just mimicked the handle implementation without actually importing it, but that should make the point).
##Result
error: Undefined Behavior: constructing invalid value: encountered a dangling reference (use-after-free)
--> src\main.rs:33:9
|
33 | static_ref
| ^^^^^^^^^^ constructing invalid value: encountered a dangling reference (use-after-free)
|
= help: this indicates a bug in the program: it performed an invalid operation, and caused Undefined Behavior
= help: see https://doc.rust-lang.org/nightly/reference/behavior-considered-undefined.html for further information
= note: BACKTRACE:
= note: inside `main` at src\main.rs:33:9: 33:19
note: some details are omitted, run with `MIRIFLAGS=-Zmiri-backtrace=full` for a verbose backtrace
error: aborting due to 1 previous error; 3 warnings emitted
error: process didn't exit successfully: `C:\Users\ROG\.rustup\toolchains\nightly-x86_64-pc-windows-msvc\bin\cargo-miri.exe runner target\miri\x86_64-pc-windows-msvc\debug\lwz.exe` (exit code: 1)
PS E:\Github\lwz>