Skip to content

Unsoundness due to std::slice::from_raw_parts usage with empty unicode strings #3

Description

@Fulgen301

std::slice::from_raw_parts must not be called with a null pointer, even if the length is 0. However, NtUnicodeStr::as_slice etc do not check whether the Buffer pointer is a null pointer, which can be the case for an empty string like one obtained by NtUnicodeString::new.

Thus

fn main() {
    dbg!(nt_string::unicode_string::NtUnicodeString::new().as_unicode_str().as_slice());
}

causes UB in safe code:

error: Undefined Behavior: constructing invalid value of type &[u16]: encountered a null reference
  --> C:\Users\user\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\nt-string-0.1.2\src\unicode_string\str.rs:36:18
   |
36 |         unsafe { slice::from_raw_parts(self.raw.buffer, self.len_in_elements()) }
   |                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Undefined Behavior occurred here
   |
   = help: this indicates a bug in the program: it performed an invalid operation, and caused Undefined Behavior
   = help: see https://doc.rust-lang.org/nightly/reference/behavior-considered-undefined.html for further information
   = note: stack backtrace:
           0: nt_string::unicode_string::NtUnicodeStr::<'_>::as_slice
               at C:\Users\user\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\nt-string-0.1.2\src\unicode_string\str.rs:36:18: 36:80
           1: main
               at src\main.rs:2:10: 2:87

note: some details are omitted, run with `MIRIFLAGS=-Zmiri-backtrace=full` for a verbose backtrace

error: aborting due to 1 previous error

error: process didn't exit successfully: `C:\Users\user\.rustup\toolchains\nightly-x86_64-pc-windows-msvc\bin\cargo-miri.exe runner target\miri\x86_64-pc-windows-msvc\debug\nt-string-repro.exe` (exit code: 1)

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions