function `set_thread_affinity()` has a potential index out of bounds issue without pre-checking #11

cicilzx · 2024-10-17T14:04:12Z

Hi, I'm developing a fuzzer to test the safe abstraction, and I found a index out of bounds panic in function set_thread_affinity(). Bellow is a test case:

#[allow(warnings, unused, non_snake_case)]
#[test]
fn test_set_thread_affinity_Ms02H() {
    let core_ids: [usize; 5] = [6204201335507100450, 4992124196634415534, 7401057722669613811, 17862441050300482797, 16130232371561991009];
    let _ = set_thread_affinity(&core_ids);
}

Output:

thread 'linux::test_set_thread_affinity_Ms02H' panicked at /local/home/zixliu/.cargo/registry/src/index.crates.io-6f17d22bba15001f/libc-0.2.159/src/unix/linux_like/linux/mod.rs:4721:9:
index out of bounds: the len is 16 but the index is 96940645867298444
stack backtrace:
   0: rust_begin_unwind
             at /rustc/d84b9037541f45dc2c52a41d723265af211c0497/library/std/src/panicking.rs:652:5
   1: core::panicking::panic_fmt
             at /rustc/d84b9037541f45dc2c52a41d723265af211c0497/library/core/src/panicking.rs:72:14
   2: core::panicking::panic_bounds_check
             at /rustc/d84b9037541f45dc2c52a41d723265af211c0497/library/core/src/panicking.rs:274:5
   3: libc::unix::linux_like::linux::CPU_SET
             at /local/home/zixliu/.cargo/registry/src/index.crates.io-6f17d22bba15001f/libc-0.2.159/src/unix/linux_like/linux/mod.rs:4721:9
   4: affinity::linux::set_thread_affinity
             at ./src/linux.rs:9:13
   5: affinity::linux::test_set_thread_affinity_Ms02H
             at ./src/linux.rs:83:13
   6: affinity::linux::test_set_thread_affinity_Ms02H::{{closure}}
             at ./src/linux.rs:70:36
   7: core::ops::function::FnOnce::call_once
             at /rustc/d84b9037541f45dc2c52a41d723265af211c0497/library/core/src/ops/function.rs:250:5
   8: core::ops::function::FnOnce::call_once
             at /rustc/d84b9037541f45dc2c52a41d723265af211c0497/library/core/src/ops/function.rs:250:5
note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.

I think checking the scope of core_ids before unsafe block would make the external API more robust.

affinity/src/linux.rs

Line 6 in 6483cc7

let mut set: cpu_set_t = unsafe { zeroed() };

The text was updated successfully, but these errors were encountered:

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

function `set_thread_affinity()` has a potential index out of bounds issue without pre-checking #11

function `set_thread_affinity()` has a potential index out of bounds issue without pre-checking #11

function set_thread_affinity() has a potential index out of bounds issue without pre-checking #11

function set_thread_affinity() has a potential index out of bounds issue without pre-checking #11

Comments

function `set_thread_affinity()` has a potential index out of bounds issue without pre-checking #11

function `set_thread_affinity()` has a potential index out of bounds issue without pre-checking #11