-
Notifications
You must be signed in to change notification settings - Fork 34
Open
Description
Hi, I am scanning this crate in the latest version using my own static analyzer tool.
Unsafe pointer conversion is found at: src/frameworks/opencl/api/memory.rs:21
pub fn create_buffer(
context: &Context,
flags: MemoryFlags,
size: usize,
host_pointer: Option<*mut u8>,
) -> Result<Memory, Error> {
let host_ptr = host_pointer.unwrap_or(ptr::null_mut());
Ok(Memory::from_c(try!(unsafe {
API::ffi_create_buffer(
context.id() as *mut libc::c_void,
flags.bits(),
size,
host_ptr as *mut libc::c_void,
)
})))
}
This unsound implementation would create memory issues such as overflow, underflow, or misalignment. The attacker can manipulate the argument size
associated with the c_void
pointer with large value, which can lead to buffer overflow bug. This can further corrupt the C/C++ code.
This would cause undefined behaviors in Rust. Adversaries can manipulate the arguments to cause memory safety bugs. I am reporting this issue for your attention.
Metadata
Metadata
Assignees
Labels
No labels