Yechan Bae

Misbehaving `HandleLike` implementation can lead to memory safety violation

1

https://github.com/shawnscode/crayon/blob/48d4e879996e2502e0faaf36e4dbcebfca9961b0/src/utils/handle.rs#L90-L94 https://github.com/shawnscode/crayon/blob/48d4e879996e2502e0faaf36e4dbcebfca9961b0/src/utils/object_pool.rs#L48-L66 https://github.com/shawnscode/crayon/blob/48d4e879996e2502e0faaf36e4dbcebfca9961b0/src/utils/object_pool.rs#L164-L174 # Description Unsafe code in `ObjectPool` has time-of-check to time-of-use (TOCTOU) bug that can eventually lead to a memory safety violation. `ObjectPool` and `HandlePool` implicitly assumes that...

Inconsistent capacity handling in `HeaderMap::with_capacity`

3

https://github.com/hyperium/http/blob/9c05e391e00474abaa8c14a86bcb0fc5eff1120e/src/header/map.rs#L473 https://github.com/hyperium/http/blob/9c05e391e00474abaa8c14a86bcb0fc5eff1120e/src/header/map.rs#L635 https://github.com/hyperium/http/blob/9c05e391e00474abaa8c14a86bcb0fc5eff1120e/src/header/map.rs#L1592 `HeaderMap::with_capacity` reserves the entry vector with `Vec::with_capacity(raw_cap)`, while other functions reserves the same entry with `Vec::with_capacity(usable_capacity(raw_cap))`.

Memory safe violation by abusing `__private_get_type_id__`

1

I noticed that it is possible to cause type confusion in downcast by manually implementing `__private_get_type_id__`. https://play.rust-lang.org/?version=stable&mode=debug&edition=2018&gist=ad66fe439660eb8373996bfd6bd7a835 Although the name of the function clearly shows that it is a private...

API soundness issue in `raw_slice` and `raw_slice_mut`

1

The current definition of `raw_slice` and `raw_slice_mut` creates `'a` bounded reference from `&self`. Since the returned slice is created from a stored pointer in `&self`, it should be bounded by...

지디넷 간헐적인 광고 팝업 발생

4

http://www.zdnet.co.kr/news/news_view.asp?artice_id=20141214171427 웹브라우저의 포커스가 잡힐 때, 간혹 새 탭에 광고가 열립니다.

> Hello, > > Just fyi: your zip-encrypted files are vuln to known plaintext attack. > You may want to fix that ;) > from gros Replace old zip encryption...

The SOSP paper and the artifact evaluation used Rudra `nightly-2020-08-26` version. After the paper publication, two more versions are released, `2021-08-20` and `2021-10-20`. However, while reviewing [#55](https://github.com/sslab-gatech/Rudra/pull/55#issuecomment-1938190310), I found that...

```toml name = "a" [binary] os = "ubuntu:16.04" cmd = "./a" ``` This should be a valid `soma.toml` but currently rejected by the program with the following error. `missing field...

If [`publish_all_ports`](https://docs.rs/bollard/0.1.1/bollard/container/struct.HostConfig.html#structfield.publish_all_ports) option is used, a container will allocate unused ports automatically when it starts. To handle this scenario, 1. `port` becomes optional in run command and `ops::run`. 2. `HostConfig`...

If the value of `public` attribute is different among configurations, we are going to use [any with exceptional rejection](https://github.com/PLUS-POSTECH/soma/issues/80#issuecomment-459378515) strategy. > As public attribute has a default value of "false",...