rhaiscript / rhai

Rhai - An embedded scripting language for Rust.
https://crates.io/crates/rhai
Apache License 2.0
3.77k stars 178 forks source link

smartstring is unsound and has UB #816

Open MolotovCherry opened 8 months ago

MolotovCherry commented 8 months ago

In part of my miri testing of Rhai, I've discovered that the smartstring crate is unsound in general. After spending many hours tracking down the cause of the UB, I finally narrowed it down and found an issue report for the exact UB. The example I posted also introduces the same UB in Rhai when using the ImmutableString type. (Though it's not limited to my example)

I don't know what the exact unsound conditions for the UB are, but I'm sure someone has accidentally triggered it in Rhai (as I have as well).

The same UB mentioned in the issue below can also be triggered with a var.into() for ImmutableString in Rhai.

Since the last update for this crate was ~2 years ago, I have some doubts on whether the UB will ever be fixed. https://github.com/bodil/smartstring/issues/49

Note, there IS a PR with the fix as far as I can tell, but the author seems to have been unresponsive to issues/PRs. This could be quickly patched by cloning the repo and using that one instead however

For any people who see this and want to fix the potential UB, see this PR for the fix, clone the repo and commit the fix, then place the following lines in your Cargo.toml:

[patch.crates-io]
smartstring = { git = "URL to your patched git repo" }
schungx commented 8 months ago

There is a way to use a GitHub PR in Cargo.toml...

[patch.crates-io]
smartstring = { git = "https://github.com/bodil/smartstring", ref = "refs/pull/34/head" }