Skip to content

Unsoundness due to std::slice::from_raw_parts usage with empty unicode strings #3

Description

@Fulgen301

std::slice::from_raw_parts must not be called with a null pointer, even if the length is 0. However, NtUnicodeStr::as_slice etc do not check whether the Buffer pointer is a null pointer, which can be the case for an empty string like one obtained by NtUnicodeString::new.

Thus

fn main() {
    dbg!(nt_string::unicode_string::NtUnicodeString::new().as_unicode_str().as_slice());
}

causes UB in safe code:

error: Undefined Behavior: constructing invalid value of type &[u16]: encountered a null reference
  --> C:\Users\user\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\nt-string-0.1.2\src\unicode_string\str.rs:36:18
   |
36 |         unsafe { slice::from_raw_parts(self.raw.buffer, self.len_in_elements()) }
   |                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Undefined Behavior occurred here
   |
   = help: this indicates a bug in the program: it performed an invalid operation, and caused Undefined Behavior
   = help: see https://doc.rust-lang.org/nightly/reference/behavior-considered-undefined.html for further information
   = note: stack backtrace:
           0: nt_string::unicode_string::NtUnicodeStr::<'_>::as_slice
               at C:\Users\user\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\nt-string-0.1.2\src\unicode_string\str.rs:36:18: 36:80
           1: main
               at src\main.rs:2:10: 2:87

note: some details are omitted, run with `MIRIFLAGS=-Zmiri-backtrace=full` for a verbose backtrace

error: aborting due to 1 previous error

error: process didn't exit successfully: `C:\Users\user\.rustup\toolchains\nightly-x86_64-pc-windows-msvc\bin\cargo-miri.exe runner target\miri\x86_64-pc-windows-msvc\debug\nt-string-repro.exe` (exit code: 1)

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions