Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Missing check in ArrayVec::insert leads to out-of-bounds write. #4

Closed
ammaraskar opened this issue Sep 24, 2020 · 1 comment
Closed

Comments

@ammaraskar
Copy link

ArrayVec::insert allows insertion of an element into the array object into the specified index. Due to a missing check on the upperbound of this index, it is possible to write out of bounds.

#![forbid(unsafe_code)]

use stack::{ArrayVec, Vector, Array};

fn main() {
    // 1. `Vector::insert` is missing an upper bounds-check on its index
    //    allowing for arbitrary memory writes.
    //
    // In debug mode this will panic with integer overflow. In release mode it
    // segfaults the program when it writes junk into the heap.
    //
    // https://github.com/arcnmx/stack-rs/blob/76cc1855a3ce966182bcf6fb2dc6a1d765cb5138/src/vector.rs#L51-L60
    let mut vec : ArrayVec<[u8; 2]> = ArrayVec::with_capacity(2);
    vec.insert(5, 0x41);

    // 2. The `array` in `ArrayVec` uses `std::mem::uninitialized`. While this
    //    isn't a big concern, seeing as only a few types are allowed to inhabit
    //    ArrayVec<T>, this should be replaced. See https://github.com/servo/rust-smallvec/issues/126
}

Issue number 2 is pointed out in #3.

@ammaraskar
Copy link
Author

Thank you for the quick fix!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant