Skip to content

Unsound problem in JitDumpFile::dump_code_load_record #8905

@safe4u

Description

@safe4u

Hi, we have found an unsound problem caused by the unsafe call std::slice::from_raw_parts in

pub fn dump_code_load_record(

from_raw_parts converts the pointer addr and the len into a slice without validation and that memory block would be dumped.
Thus, the 'safe' function dump_code_load_record is actually 'unsafe' since it requires the caller to guarantee that the addr is valid and len must not overflow.

POC

Here follows a simple POC written in safe Rust code.

use wasmtime_jit_debug::perf_jitdump::JitDumpFile;
fn main() {
    let mut jit_file = JitDumpFile::new("jitdump", 1).unwrap();
    let str1 = "hi";
    let _r = jit_file.dump_code_load_record("name", str1.as_ptr() as *const u8, 1024, 2, 3, 4).unwrap();
}

Suggestion

There are two possible action choices could be taken:

  1. Mark the function dump_code_load_record as unsafe and write Safety requirement.
  2. (recommended) Merge parameter addr and len into a single parameter code_buffer: &[u8], so the compiler would guarantee the buffer is valid.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions