- Reported
-
- Issued
-
- Package
-
lockfree
(crates.io)
- Type
-
INFO
Unsound
- Categories
-
- Keywords
-
#panic-safety
#memory-safety
#use-after-free
#double-free
#uninitialized
- References
-
- Patched
-
no patched versions
- Affected Functions
- Version
lockfree::channel::mpmc::SharedIncin::clear-
lockfree::channel::spmc::SharedIncin::clear-
lockfree::map::Map::into_iter-
lockfree::map::SharedIncin::clear-
lockfree::queue::SharedIncin::clear-
lockfree::stack::SharedIncin::clear-
Description
Two independent soundness problems, both reachable from safe Rust.
Map::into_iter drops builder (the caller-supplied hasher H) and incin by
hand, then commits the ownership transfer with mem::forget(self). H::drop is
user code and may panic. If it does, mem::forget(self) is skipped and the
still-live Map unwinds, whose field drop glue destroys builder a second
time. An empty map is enough — no entries or concurrency required.
SharedIncin::clear writes mem::uninitialized::<Arc<_>>() into self.inner
before taking the real Arc out. Arc has a validity invariant, so this is
undefined behaviour at the point of creation, with no panic or concurrency
involved. Between that write and the repairing one, self.inner also holds
garbage while self is still droppable, so an unwind from incin.clear() or
Arc::new decrements a refcount through an uninitialized pointer. The
make_shared_incin! macro is instantiated five times, so this covers queue,
stack, map, channel::spmc and channel::mpmc.
Impact
- CWE-415 (Double Free): the same allocation is freed twice.
- CWE-416 (Use-After-Free): a freed allocation is accessed during a repeated
Drop.
- CWE-908 (Use of Uninitialized Resource): an
Arc is constructed from uninitialized bytes.
Fix
No fixed release is available. The crate has had no release since 2018-11-18 and
the maintainer has not responded to the report.
Advisory available under CC0-1.0
license.