static-box icon indicating copy to clipboard operation
static-box copied to clipboard

Uninitialized memory can be written to the buffer

Open stevenengler opened this issue 1 year ago • 0 comments

For example, padding bytes will be written to the buffer and can later be read back.

use std::fmt::Debug;
use static_box::Box as StaticBox;

fn main() {
    let x = (5u8, 10u16);
    let mut buf = [0; 32];
    {
        let debug = StaticBox::<dyn Debug>::new(&mut buf, x);
        println!("{:?}", &*debug);
    }
    println!("{buf:?}");
}
$ cargo +nightly miri run
    Finished dev [unoptimized + debuginfo] target(s) in 0.00s
     Running `/home/user/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/bin/cargo-miri runner target/miri/x86_64-unknown-linux-gnu/debug/static-box-test`
(5, 10)
error: Undefined Behavior: using uninitialized data, but this operation requires initialized memory
   --> /home/user/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/fmt/num.rs:461:5
    |
461 | /     impl_Display!(
462 | |         i8, u8, i16, u16, i32, u32, i64, u64, usize, isize
463 | |             as u64 via to_u64 named fmt_u64
464 | |     );
    | |_____^ using uninitialized data, but this operation requires initialized memory
    |
    = help: this indicates a bug in the program: it performed an invalid operation, and caused Undefined Behavior
    = help: see https://doc.rust-lang.org/nightly/reference/behavior-considered-undefined.html for further information
    = note: BACKTRACE:
    = note: inside `core::fmt::num::imp::<impl std::fmt::Display for u8>::fmt` at /home/user/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/fmt/num.rs:280:38: 280:43
    = note: inside `core::fmt::num::<impl std::fmt::Debug for u8>::fmt` at /home/user/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/fmt/num.rs:191:21: 191:47
    = note: inside `<&u8 as std::fmt::Debug>::fmt` at /home/user/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/fmt/mod.rs:2396:62: 2396:82
    = note: inside closure at /home/user/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/fmt/builders.rs:394:17: 394:36
    = note: inside `std::result::Result::<(), std::fmt::Error>::and_then::<(), [closure@core::fmt::builders::DebugInner<'_, '_>::entry::{closure#0}]>` at /home/user/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/result.rs:1341:22: 1341:27
    = note: inside `core::fmt::builders::DebugInner::<'_, '_>::entry` at /home/user/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/fmt/builders.rs:380:23: 396:11
    = note: inside `std::fmt::DebugList::<'_, '_>::entry` at /home/user/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/fmt/builders.rs:599:9: 599:32
    = note: inside `std::fmt::DebugList::<'_, '_>::entries::<&u8, std::slice::Iter<'_, u8>>` at /home/user/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/fmt/builders.rs:633:13: 633:31
    = note: inside `<[u8] as std::fmt::Debug>::fmt` at /home/user/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/fmt/mod.rs:2622:9: 2622:44
    = note: inside `<&[u8] as std::fmt::Debug>::fmt` at /home/user/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/fmt/mod.rs:2396:62: 2396:82
    = note: inside `std::array::<impl std::fmt::Debug for [u8; 32]>::fmt` at /home/user/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/array/mod.rs:314:9: 314:39
    = note: inside `std::fmt::write` at /home/user/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/fmt/mod.rs:1232:17: 1232:59
    = note: inside `<std::io::StdoutLock<'_> as std::io::Write>::write_fmt` at /home/user/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/io/mod.rs:1684:15: 1684:43
    = note: inside `<&std::io::Stdout as std::io::Write>::write_fmt` at /home/user/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/io/stdio.rs:715:9: 715:36
    = note: inside `<std::io::Stdout as std::io::Write>::write_fmt` at /home/user/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/io/stdio.rs:689:9: 689:33
    = note: inside `std::io::stdio::print_to::<std::io::Stdout>` at /home/user/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/io/stdio.rs:1007:21: 1007:47
    = note: inside `std::io::_print` at /home/user/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/io/stdio.rs:1074:5: 1074:37
note: inside `main`
   --> src/main.rs:12:5
    |
12  |     println!("{buf:?}");
    |     ^^^^^^^^^^^^^^^^^^^
    = note: this error originates in the macro `impl_Display` which comes from the expansion of the macro `println` (in Nightly builds, run with -Z macro-backtrace for more info)

note: some details are omitted, run with `MIRIFLAGS=-Zmiri-backtrace=full` for a verbose backtrace

error: aborting due to previous error

A fix would be to require the buffer be a &mut [MaybeUninit<u8>] instead.

stevenengler avatar Mar 15 '23 18:03 stevenengler