futures-timer icon indicating copy to clipboard operation
futures-timer copied to clipboard

Function `futures-timer/src/native/global/raw_drop`, `raw_wake`, `raw_clone`, and `raw_wake_by_ref` can trigger invalid memory reference

Open cicilzx opened this issue 1 year ago • 0 comments

Hi, I'm developing a fuzzer to test the safe abstraction, and I found some memory issues when calling function futures-timer/src/native/global/raw_drop, raw_wake, raw_clone, and raw_wake_by_ref.

Below are some test cases:

// case1:
#[test]
fn test_raw_drop_ikeZT() {
    let ptr: Vec<()> = vec![];
    let _ = raw_drop(ptr.as_ptr());
}

// case2:
fn test_raw_wake_JvToH() {
    let ptr: Vec<()> = vec![()];
    let _ = raw_wake(ptr.as_ptr());
}

// case3:
fn test_raw_clone_dGcoO() {
    let ptr: Vec<()> = vec![];
    let _ = raw_clone(ptr.as_ptr());
}

//case4:
fn test_raw_wake_by_ref_9Jhw9() {
    let ptr: Vec<()> = vec![];
    let _ = raw_wake_by_ref(ptr.as_ptr());
}

The outputs are:

error: test failed, to rerun pass `-p futures-timer --lib`

Caused by:
  process didn't exit successfully: `/Users/liuzixi/Documents/futures-timer/target/debug/deps/futures_timer-f3d22d0c7e0e06d3 'native::global::test_raw_drop_ikeZT' --exact --show-output` (signal: 11, SIGSEGV: invalid memory reference)

cicilzx avatar Oct 06 '24 21:10 cicilzx