Skip to content

Multiple unsound issue #54

@lwz23

Description

@lwz23

Hello,

Thank you for your work on this project. While auditing Rust code for memory safety issues, I discovered a potential soundness problem in the facade module.

considering the following code:

fn handle_from_ext(handle: u64) -> &'static Handle {
        let handle_ptr = handle as *mut Handle;
        unsafe { &*handle_ptr }
    }

Although this is a private fn, I notice there are multiple pub fn that can flow into this function.
pub fn as_currency -> fn handle_from_ext
pub fn as_error -> fn handle_from_ext
pub fn as_pricer_factory -> fn handle_from_ext
pub fn clone_handle -> fn handle_from_ext
pub fn as_market_data -> fn handle_from_ext
pub fn as_fixing_table -> fn handle_from_ext
pub fn as_report_generator -> fn handle_from_ext
pub fn as_instrument -> fn handle_from_ext
pub fn is_error -> fn handle_from_ext

I believe it cause UB and my PoC is below(For convenience, I've just mimicked the handle implementation without actually importing it, but that should make the point).

##Result

error: Undefined Behavior: constructing invalid value: encountered a dangling reference (use-after-free)
  --> src\main.rs:33:9
   |
33 |         static_ref
   |         ^^^^^^^^^^ constructing invalid value: encountered a dangling reference (use-after-free)
   |
   = help: this indicates a bug in the program: it performed an invalid operation, and caused Undefined Behavior
   = help: see https://doc.rust-lang.org/nightly/reference/behavior-considered-undefined.html for further information        
   = note: BACKTRACE:
   = note: inside `main` at src\main.rs:33:9: 33:19

note: some details are omitted, run with `MIRIFLAGS=-Zmiri-backtrace=full` for a verbose backtrace

error: aborting due to 1 previous error; 3 warnings emitted

error: process didn't exit successfully: `C:\Users\ROG\.rustup\toolchains\nightly-x86_64-pc-windows-msvc\bin\cargo-miri.exe runner target\miri\x86_64-pc-windows-msvc\debug\lwz.exe` (exit code: 1)
PS E:\Github\lwz> 

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions