bsuccinct-rs
bsuccinct-rs copied to clipboard
possible unsound code
hello, thank you for your contribution in this project, I am scanning the unsoundness problem in rust project. I notice the following code:
https://github.com/beling/bsuccinct-rs/blob/eeedbce79d01a441b365248fe8179556ef9f4a78/ph/src/seeds.rs#L230
fn set_seed(&self, vec: &mut [Self::VecElement], index: usize, seed: u16) {
debug_assert!(seed < 256);
//vec[index] = seed as u8
unsafe { *vec.get_unchecked_mut(index) = seed as u8 }
}
In my opinion, set_seed is a function declared as pub (due to pub trait). index can be assigned any usize type, which may result in UB when performing the unsafe operation " unsafe { *vec.get_unchecked_mut(index) = seed as u8 }", OOB access. Since this is a library published on crate.io, I thought it might be worth reporting this issue. Because according to Rust's safety spec, any code that could cause UB should be marked as unsafe.
I don't have access to the ph module from crates.io, so I'm guessing you won't be able to call this code directly, but it's still unsound, and I'm opening this issue for the author's reference.
same for https://github.com/beling/bsuccinct-rs/blob/eeedbce79d01a441b365248fe8179556ef9f4a78/ph/src/seeds.rs#L101 which may also OOB.
Thanks. I'll fix it, probably by marking get_seed and set_seed as unsafe. Note that this API is intended to be internal and the caller ensures that the indexes are correct.