Skip to content

Unsound issue in Trailer #2

@CXWorks

Description

@CXWorks

Hi, thanks for your time to read this issue.

Our static analyzer find a potential unsound issue in the construction of Trailer, where it doesn't provide enough check to ensure the soundness.

trailer/src/lib.rs

Lines 18 to 25 in d474984

pub fn new(capacity: usize) -> Trailer<T> {
unsafe {
let trailer = Trailer::allocate(capacity);
let ptr = trailer.ptr as *mut T;
ptr.write(T::default());
trailer
}
}

The constructor does check the T is not a ZST in rust, and allocating with size 0 is considered as undefined behaviors in Rust. A poc code like below can work:

use trailer::Trailer;
#[derive(Default)]
struct Zst;

fn main() {
    let mut a = Trailer::<Zst>::new(0);
    drop(a);
}

Thanks again for your time.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions