-
Notifications
You must be signed in to change notification settings - Fork 6
Open
Description
Hi, I am scanning this crate in the latest version using my own static analyzer tool.
Unsafe pointer conversion is found at:
let read_size = glfs_pread(
self.file_handle,
fill_buffer.as_mut_ptr() as *mut c_void,
count,
offset,
flags,
);This unsound implementation would create memory issues such as overflow, underflow, or misalignment. The attacker can manipulate the argument count, offset associated with the c_void pointer with a large value, which can lead to a buffer overflow bug. The c_void pointer and its associated size argument are passed through the FFI (glfs_pread), which can further corrupt the C/C++ code.
This would cause undefined behaviors in Rust. Adversaries can manipulate the associated size argument to cause memory safety bugs. I am reporting this issue for your attention.
cholcombe973
Metadata
Metadata
Assignees
Labels
No labels