You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Hi there, we (the Rust group at @sslab-gatech) are auditing crates on crates.io for safety issues and noticed that the Shared object seems to not have bounds on its Send/Sync traits:
We weren't sure if this was intentional since this is a testing library but this can be used to create data races from safe Rust by sharing types like Cell:
#![forbid(unsafe_code)]use model::Shared;use std::cell::Cell;use crossbeam_utils::thread;#[derive(Debug,Clone,Copy)]enumRefOrInt<'a>{Ref(&'a u64),Int(u64)}staticSOME_INT:u64 = 123;fnmain(){let cell = Cell::new(RefOrInt::Ref(&SOME_INT));let shared = Shared::new(&cell);
thread::scope(|s| {
s.spawn(move |_| {loop{// Repeatedly write Ref(&addr) and Int(0xdeadbeef) into the cell.
shared.set(RefOrInt::Ref(&SOME_INT));
shared.set(RefOrInt::Int(0xdeadbeef));}});loop{ifletRefOrInt::Ref(addr) = cell.get(){// Hope that between the time we pattern match the object as a// `Ref`, it gets written to by the other thread.if addr as*constu64 == &SOME_INTas*constu64{continue;}// Due to the data race, obtaining Ref(0xdeadbeef) is possibleprintln!("Pointer is now: {:p}", addr);println!("Dereferencing addr will now segfault: {}",*addr);}}});}
which outputs:
Pointer is now: 0xdeadbeef
Return Code: -11 (SIGSEGV)
The text was updated successfully, but these errors were encountered:
Since the project is intended for testing rather than production environments, it is surfaced as a warning rather than an error.
Once a fix is released to crates.io, please open a pull request to update the advisory with the patched version, or file an issue on the advisory database repository.
Hi there, we (the Rust group at @sslab-gatech) are auditing crates on crates.io for safety issues and noticed that the
Shared
object seems to not have bounds on itsSend
/Sync
traits:model/src/lib.rs
Lines 110 to 112 in b50d9ee
We weren't sure if this was intentional since this is a testing library but this can be used to create data races from safe Rust by sharing types like
Cell
:which outputs:
The text was updated successfully, but these errors were encountered: