Rafael

icon indicating a website link https://shinmao.github.io icon indicating an email [email protected]

icon company Sun Security Lab icon location Security Researcher | Graduate Research Assistant in @SunLab-GMU | PhD candidate at GMU

Results 34 issues of Rafael

Unsound implementation of `transmute_vec_as_bytes` in `fyrox-core`

3 comment

Hi, we are researchers from [SunLab](https://sunlab-gmu.github.io/). We consider the safe function `transmute_vec_as_bytes` includes the unsound implementation. ### `transmute_vec_as_bytes` https://github.com/FyroxEngine/Fyrox/blob/3b03ea717d201be24dac98cc9e8ebf812808e898/fyrox-core/src/lib.rs#L325-L331 When casting type to `u8` slice, we also need to make...

good first issue

Potential uninitialized memory access in `mesalink_BIO_new_mem_buf`

Hi, I found that the function `mesalink_BIO_new_mem_buf` might incorrectly assume `buf_ptr` points to any type that has non-zero length (all the example cases also show the assumption); however, it ignores...

Unsoundness of `gaussian_blur`

I consider the `gaussian_blur` have the unsound implementation in line 32 https://github.com/Aloxaf/silicon/blob/7837ec85e40a368d5fe0a61c47b5ad0be60359dd/src/blur.rs#L23-L33 Since [`RgbaImage`](https://docs.rs/image/0.25.2/src/image/buffer.rs.html#656-661) is a struct with `repr(Rust)`, it means that it has an unstable layout and compiler preserves...

Unsoundness in `(decode/encode)_variable_primitive_vec`

### Bug and PoC Hi, we consider the following function has the unsound implementation: https://github.com/adnanademovic/rosrust/blob/c46a7e6742e5e01e0271d144ae2a05be9a035539/rosrust/src/rosmsg.rs#L217-L235 The function first defines the type of buffer it wants to fill up; then read...