rust-fuzz / libfuzzer

Rust bindings and utilities for LLVM’s libFuzzer
Apache License 2.0
206 stars 44 forks source link

Soundness issue in test_input_wrap #112

Closed gigaroby closed 9 months ago

gigaroby commented 10 months ago

While conducting an internal unsafe review @cramertj found an issue in test_input_wrap:

This function unconditionally calls from_raw_parts with the provided data and size values. It should be marked unsafe and should include a comment explaining the conditions under which it is safe to call (it could simply link to https://doc.rust-lang.org/std/slice/fn.from_raw_parts.html#safety).

https://github.com/rust-fuzz/libfuzzer/blob/c9c43f308b98a03b295e6a2e81089950b42c6ee1/src/lib.rs#L56-L72