ITADN

Soundess bug: `&mut` reference exposes uninitialized bytes

#720Openjoshlf 创建于 2025-07-11
J
joshlfcommented
These lines in `unsafe fn do_resolve` convert a `&mut [u8; _]` to a `&mut SYMBOL_INFOW`: https://github.com/rust-lang/backtrace-rs/blob/b65ab935fb2e0d59dba8966ffca09c9cc5a5f57c/src/symbolize/dbghelp.rs#L226-L227 The `SYMBOL_INFOW` type [has inter-field padding](https://play.rust-lang.org/?version=stable&mode=debug&edition=2024&gist=47bced6ac66395875c18a921c258dde2), which means that this `&mut SYMBOL_INFOW` could be used to write uninit bytes which would be exposed by the underlying `[u8; _]`. Note that the `&mut SYMBOL_INFOW` is passed to an external function: https://github.com/rust-lang/backtrace-rs/blob/b65ab935fb2e0d59dba8966ffca09c9cc5a5f57c/src/symbolize/dbghelp.rs#L234 `sym_from_addr` is an argument to this function: https://github.com/rust-lang/backtrace-rs/blob/b65ab935fb2e0d59dba8966ffca09c9cc5a5f57c/src/symbolize/dbghelp.rs#L221 Any call to `do_resolve` which passes a `sym_from_addr` argument which writes to these padding locations would cause undefined behavior. I would recommend modifying `SYMBOL_INFOW` with [explicit padding fields](https://play.rust-lang.org/?version=stable&mode=debug&edition=2024&gist=32f8dde82e9cf539bc3f151db744ca16) to mitigate this problem.
0 条评论