Speykious / cve-rs

Blazingly 🔥 fast 🚀 memory vulnerabilities, written in 100% safe Rust. 🦀
Other
3.72k stars 94 forks source link

Test that derived code works with `std::mem::transmute` #35

Open turalcar opened 3 months ago

turalcar commented 3 months ago

The main offender is download_more_ram() that converts 0 to a pointer. https://github.com/Speykious/cve-rs/blob/ab0d48fd6e2f30a0cc98e5833c44148eae1e4436/src/lib.rs#L105 With std::mem::transmute this causes time-travelling UB: compiler concludes that the only way we could get 0 here is by failing unwrap() few lines prior. The simple solution would be to use 1usize and 2usize to deduce the slice pointer layout or just assume that the pointer goes first - it's not the end of the world. This prevents removing #[inline(never)] in the implementation of transmute().