Skip to content

Unsound usages of unsafe implementation from T to c_void #7

Description

@llooFlashooll

Hi, I am scanning this crate in the latest version using my own static analyzer tool.

Unsafe pointer conversion is found at: src/message.rs:119

pub fn append<T>(msg: &mut NetlinkMessage, data: &T, len: u32, pad: i32) -> i32 {
    unsafe { 
        let vptr: *const c_void = mem::transmute(data);
        nlmsg_append(msg.ptr, vptr, len as size_t, pad as c_int) as i32 
    }
}

This unsound implementation would create memory issues such as overflow, underflow, or misalignment, since the type T is converted to c_void (1 byte, 8 bits). The attacker can manipulate the argument len associated with the c_void pointer with large value, which can lead to buffer overflow bug. This can further corrupt the C/C++ code.

This would cause undefined behaviors in Rust. I am reporting this issue for your attention.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions