okready / scratchpad Goto Github PK

Hello,
we (Rust group @sslab-gatech) found a memory-safety/soundness issue in this crate while scanning Rust code on crates.io for potential vulnerabilities.

Issue Description

Two functions allow double-drop of an object upon panic: <T as traits::SliceMoveSource<[<T as traits::Array>::Item]>>::move_elements(), <std::boxed::Box<T> as traits::SliceMoveSource<T>>::move_elements(). Both functions take user-provided closure as parameter, and a double drop of an object happens upon panic inside the user-provided closure.

Reproduction

Below is an example program that exhibits undefined behavior using safe APIs of scratchpad.

#![forbid(unsafe_code)]
use scratchpad::SliceLike;
use scratchpad::SliceMoveSource;

#[derive(Clone, Debug)]
struct Foo(i32);

impl Drop for Foo {
    fn drop(&mut self) {
        // This message is printed twice, indicating double-free.
        println!("I'm dropping {}", self.0);
    }
}

fn main() {
    let mut mybox = [Foo(1234); 1];

    mybox.move_elements(|s| {
        panic!("Unexpected panic");
        dbg!(s);
    });
}

thread 'main' panicked at 'Unexpected panic', src/main.rs:33:9
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
I'm dropping 1234
I'm dropping 1234

Return code 101