Skip to content

Soundess bug: &mut reference exposes uninitialized bytes #720

Open
@joshlf

Description

@joshlf

These lines in unsafe fn do_resolve convert a &mut [u8; _] to a &mut SYMBOL_INFOW:

let mut data = Aligned8([0u8; SIZE]);
let info = unsafe { &mut *data.0.as_mut_ptr().cast::<SYMBOL_INFOW>() };

The SYMBOL_INFOW type has inter-field padding, which means that this &mut SYMBOL_INFOW could be used to write uninit bytes which would be exposed by the underlying [u8; _].

Note that the &mut SYMBOL_INFOW is passed to an external function:

if sym_from_addr(info) != TRUE {

sym_from_addr is an argument to this function:

sym_from_addr: impl FnOnce(*mut SYMBOL_INFOW) -> BOOL,

Any call to do_resolve which passes a sym_from_addr argument which writes to these padding locations would cause undefined behavior.

I would recommend modifying SYMBOL_INFOW with explicit padding fields to mitigate this problem.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions