midir icon indicating copy to clipboard operation
midir copied to clipboard

Undefined behaviour in winmm backend

Open barafael opened this issue 1 year ago • 3 comments

Here, a packet is filled by bytes from a message:

https://github.com/Boddlnagg/midir/blob/db24d55a873d0213e1c61329a2f84c886430a9ce/src/backend/winmm/mod.rs#L509-L513

This is undefined behaviour, because the address of an immutable u32 is taken and cast to a *mut u8, which is then written to in an unsafe block.

I have fixes ready in #136 but these are part of a rather large patchset, so if you like I can send a small patch ahead, too.

barafael avatar Jun 20 '23 17:06 barafael

Here's a playground which you can use with Miri to see that it's actually undefined behaviour: playground link

barafael avatar Jun 20 '23 17:06 barafael

Sorry, I have somehow missed this PR! I will probably just merge #136 eventually (after #135 and a rebase), I don't think a separate PR is necessary.

Boddlnagg avatar Jul 16 '23 11:07 Boddlnagg

OK. I just did this PR because I wasn't sure you wanted to have the large blob of changes in #136 .

barafael avatar Jul 16 '23 18:07 barafael