OpenPAL3 icon indicating copy to clipboard operation
OpenPAL3 copied to clipboard

Maybe unsound in add_ref

Open lwz23 opened this issue 11 months ago • 1 comments

hello, thank you for your contribution in this project, I am scanning the unsoundness problem in rust project. I notice the following code:

pub fn add_ref(&self) -> std::os::raw::c_long {
        unsafe {
            let this = self as *const IObjectArray as *const *const std::os::raw::c_void;
            let ret = ((*self.vtable).add_ref)(this);
            let ret: std::os::raw::c_long = ret.into();

            ret
        }
    }

Considering that vtable is a pub field, I assume that users can directly manipulate this field, and that add_ref is a public function. This potential situation could result in self.vtable being a null pointer, and directly dereferencing it might trigger undefined behavior (UB). For safety reasons, I felt it necessary to report this issue. If you have performed checks elsewhere that ensure this is safe, please don’t take offense at my raising this issue.

lwz23 avatar Dec 09 '24 08:12 lwz23

and same problem for: https://github.com/dontpanic92/OpenPAL3/blob/771a2c2963ff98f6774dee0f2055d92f1445f9db/crosscom/runtime/rust/src/defs.rs#L63 https://github.com/dontpanic92/OpenPAL3/blob/771a2c2963ff98f6774dee0f2055d92f1445f9db/crosscom/runtime/rust/src/defs.rs#L73 https://github.com/dontpanic92/OpenPAL3/blob/771a2c2963ff98f6774dee0f2055d92f1445f9db/crosscom/runtime/rust/src/defs.rs#L83

lwz23 avatar Dec 09 '24 08:12 lwz23