Skip to content

Unsound usages of unsafe implementation from buf to Page #37

Open
@llooFlashooll

Description

Hi, I am scanning the jammdb in the latest version with my own static analyzer tool.

Unsafe conversion found at: src/tx.rs#L329

if let TxLock::Rw(file) = &mut self.lock {
   // write meta page to file
   {
         let mut buf = vec![0; self.db.inner.pagesize as usize];

         #[allow(clippy::cast_ptr_alignment)]
         let page = unsafe { &mut *(&mut buf[0] as *mut u8 as *mut Page) };
         let meta_page_id = u64::from(self.meta.meta_page == 0);

This unsound implementation would create a misalignment issues if the type size of buf is smaller than the type size of Page.

This would potentially cause undefined behaviors in Rust. If we further manipulate the problematic converted types, it would potentially lead to different consequences such as access out-of-bound. I am reporting this issue for your attention.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions