Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Maybe unsound in Cursor::new #210

Open
lwz23 opened this issue Dec 10, 2024 · 1 comment
Open

Maybe unsound in Cursor::new #210

lwz23 opened this issue Dec 10, 2024 · 1 comment

Comments

@lwz23
Copy link

lwz23 commented Dec 10, 2024

Hello, thank you for your contribution in this project, I am scanning the unsoundness problem in rust project.
I notice the following code:

pub struct Cursor<'a> {
    cursor: sys::ecs_meta_cursor_t,
    phantom: std::marker::PhantomData<&'a ()>,
}

impl<'a> Cursor<'a> {
    /// Creates a new cursor instance
    #[allow(clippy::not_unsafe_ptr_arg_deref)]
    pub fn new(
        world: impl WorldProvider<'a>,
        type_id: impl Into<Entity>,
        ptr: *mut std::ffi::c_void,
    ) -> Self {
        let world = world.world_ptr();
        let type_id = *type_id.into();
        let cursor = unsafe { sys::ecs_meta_cursor(world, type_id, ptr) };
        Self {
            cursor,
            phantom: std::marker::PhantomData,
        }
    }

Considering that pub mod addons, and new is also a pub function. I assume that users can directly call this function. This potential situation could result in sys::ecs_meta_cursor(world, type_id, ptr) operating on a null pointer, and directly dereferencing it might trigger undefined behavior (UB). For safety reasons, I felt it necessary to report this issue. If you have performed checks elsewhere that ensure this is safe, please don’t take offense at my raising this issue.
I suggest Several possible fixes:

  1. If there is no external usage for Cursor or new, they should not marked as pub, at least its new should not marked as pub
  2. new method should add additional check for null pointer.
  3. mark new method as unsafe and proper doc to let users know that they should provide valid Pointers.
@lwz23
Copy link
Author

lwz23 commented Dec 16, 2024

ping

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant