-
Notifications
You must be signed in to change notification settings - Fork 332
Maybe multiple unsound problem in c_api #1305
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Comments
maybe same problem for RedisJSON/redis_json/src/c_api.rs Line 211 in 93d8c18
it checked str is not null but didn't check len is not null
|
ping |
maybe same problem for RedisJSON/redis_json/src/c_api.rs Line 93 in 93d8c18
RedisJSON/redis_json/src/c_api.rs Line 104 in 93d8c18
RedisJSON/redis_json/src/c_api.rs Line 120 in 93d8c18
RedisJSON/redis_json/src/c_api.rs Line 124 in 93d8c18
RedisJSON/redis_json/src/c_api.rs Line 141 in 93d8c18
RedisJSON/redis_json/src/c_api.rs Line 152 in 93d8c18
RedisJSON/redis_json/src/c_api.rs Line 169 in 93d8c18
RedisJSON/redis_json/src/c_api.rs Line 181 in 93d8c18
RedisJSON/redis_json/src/c_api.rs Line 197 in 93d8c18
RedisJSON/redis_json/src/c_api.rs Line 211 in 93d8c18
....................... In fact, I recommend that all pub functions that accept a bare pointer as an argument be marked as unsafe or adequately checked for validity..... Since most of these codes are likely to be used only internally, I recommend marking them as unsafe or declaring them as pub(crate) |
@lwz23 Thank you for your recommendation. We will review it, make the necessary changes, and address it accordingly. |
hello, thank you for your contribution in this project, I am scanning the unsoundness problem in rust project.
I notice the following code:
Considering pub mod c_api and this is a pub function, I assume user can directly call to this function, if it's this case , I think there may exist a unsound problem in this code, eg. maybe str is null? It will lead to UB. I suggest mark this function as unsafe or add additional check to varify the pointer. I chose to report this issue for security reasons, but don't mind if the function is not intended for external use and should be marked as
pub(crate)
, or if this is an error report and there is actually no unsound problem.The text was updated successfully, but these errors were encountered: