Skip to content

Missing check in ArrayVec::insert leads to out-of-bounds write. #4

Closed
@ammaraskar

Description

@ammaraskar

ArrayVec::insert allows insertion of an element into the array object into the specified index. Due to a missing check on the upperbound of this index, it is possible to write out of bounds.

#![forbid(unsafe_code)]

use stack::{ArrayVec, Vector, Array};

fn main() {
    // 1. `Vector::insert` is missing an upper bounds-check on its index
    //    allowing for arbitrary memory writes.
    //
    // In debug mode this will panic with integer overflow. In release mode it
    // segfaults the program when it writes junk into the heap.
    //
    // https://github.com/arcnmx/stack-rs/blob/76cc1855a3ce966182bcf6fb2dc6a1d765cb5138/src/vector.rs#L51-L60
    let mut vec : ArrayVec<[u8; 2]> = ArrayVec::with_capacity(2);
    vec.insert(5, 0x41);

    // 2. The `array` in `ArrayVec` uses `std::mem::uninitialized`. While this
    //    isn't a big concern, seeing as only a few types are allowed to inhabit
    //    ArrayVec<T>, this should be replaced. See https://github.com/servo/rust-smallvec/issues/126
}

Issue number 2 is pointed out in #3.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions