Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

smartstring is unsound and has UB #816

Open
MolotovCherry opened this issue Jan 17, 2024 · 1 comment
Open

smartstring is unsound and has UB #816

MolotovCherry opened this issue Jan 17, 2024 · 1 comment

Comments

@MolotovCherry
Copy link

MolotovCherry commented Jan 17, 2024

In part of my miri testing of Rhai, I've discovered that the smartstring crate is unsound in general. After spending many hours tracking down the cause of the UB, I finally narrowed it down and found an issue report for the exact UB. The example I posted also introduces the same UB in Rhai when using the ImmutableString type. (Though it's not limited to my example)

I don't know what the exact unsound conditions for the UB are, but I'm sure someone has accidentally triggered it in Rhai (as I have as well).

The same UB mentioned in the issue below can also be triggered with a var.into() for ImmutableString in Rhai.

Since the last update for this crate was ~2 years ago, I have some doubts on whether the UB will ever be fixed.
bodil/smartstring#49

Note, there IS a PR with the fix as far as I can tell, but the author seems to have been unresponsive to issues/PRs. This could be quickly patched by cloning the repo and using that one instead however

For any people who see this and want to fix the potential UB, see this PR for the fix, clone the repo and commit the fix, then place the following lines in your Cargo.toml:

[patch.crates-io]
smartstring = { git = "URL to your patched git repo" }
@schungx
Copy link
Collaborator

schungx commented Jan 18, 2024

There is a way to use a GitHub PR in Cargo.toml...

[patch.crates-io]
smartstring = { git = "https://github.com/bodil/smartstring", ref = "refs/pull/34/head" }

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants