-
-
Notifications
You must be signed in to change notification settings - Fork 3
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fix unsoundness in PdInfo::as_struct() #18
Conversation
ce17c64
to
7062a36
Compare
21e9c32
to
e10b0a6
Compare
e10b0a6
to
aae2afa
Compare
Thanks for the PR and yes both issues are valid issues. Even with the fix, we are allocating and leaking memory in these cases because LibOSDP makes make a copy of all the members and doesn't care about Perhaps the C structures should only hold references to the Rust types that way they get dropped correctly. Ofc, this would mean significant change to different parts of this project :) Do you have any opinions on this matter? |
You are right - LibOSDP does copy To prevent the leak of What do you think? I will rebase this PR after #17 is merged. |
This is an oversight. The general rule is to not make any assumptions on the lifetime of user provided data. I will fix this the upcoming release in LibOSDP.
I haven't reviewed this PR yet but the idea of |
363eac5
to
6250044
Compare
As I said, it was not pretty. I changed it to a wrapper type instead. That is cleaner IMO. |
6250044
to
3c36def
Compare
Merged this PR locally after some minor fixups (GitHub did not allow me to push the modifications to this PR for some reason). Thanks for the PR :) |
Since
PdInfo.scbk
's lifetime is bound toPdInfo
,osdp_pd_info_t
may outlive it. Currently it would still hold a reference toPdInfo
'sscbk
which would be unsound.This fixes this by effectively cloning
scbk
so that it has a'static
lifetime.Another option would be to change
PdInfoBuilder::secure_channel_key
to accept a&'static [u8;16]
instead. This would get rid of the unsoundness too and would not require a heap allocation per PD. This would change the API and might make it slightly more difficult to use, but may be worth it.What do you think?
Edit:
I just realized that (almost) the same goes for the
name
andcap
fields. And I am pretty sure thatcap
needs to be eitherNULL
or end with a(-1, 0, 0)
sentinel so I changed that, too.