search

rust-lang / flate2-rs

DEFLATE, gzip, and zlib bindings for Rust
https://docs.rs/flate2
Apache License 2.0
900 stars 162 forks source link

flate2-rs with zlib may be unsound due to calls to `getenv` #272

Closed xerxes12354 closed 3 years ago

xerxes12354 commented 3 years ago

I was looking at the time crate wondering why the time crate didn't give offsets, and I stumbled upon this thread on Internals. This seems like a big problem so I went looking for FFI crates where this could be a problem.

This only occurs on ARM because the getenv call is only for ARM feature detection.

zlib-ng uses getenv https://github.com/zlib-ng/zlib-ng/blob/9f784908599006e9f09599b85b495bdcda1f25c4/arch/arm/armfeature.c#L21, it looks like this wrapper has a data race when set_env is called in another thread.

alexcrichton commented 3 years ago

Thanks for the report, but you can't reasonably expect all Rust projects which call C to magically handle this. Opening an issue on each separate repository I don't think is productive.

xerxes12354 commented 3 years ago

This exposes an unsound API to safe code, violating safety guarantees.