Skip to content

Conversation

@Naveed8951
Copy link

Summary

This patch fixes a memory-safety issue in Rust code generated by flatc
where table scalar setters and mutators could perform out-of-bounds
writes when operating on malformed or undersized buffers.

Vulnerability Details

Rust-generated table setters write scalar values directly into the
backing &mut [u8] buffer using pointer copies without first verifying
that the buffer is large enough for the write.

If a wrapper is constructed over a buffer shorter than
OFFSET + sizeof(T), calling a generated set_* or mutate_* method
would write past the end of the slice, causing undefined behavior and
memory corruption. Because these methods are safe (not unsafe fn),
this allows memory corruption from safe Rust code.

Fix

  • Updated Rust code generation to first obtain a bounds-checked mutable
    subslice using get_mut(OFFSET..OFFSET+size)
  • Only perform the unsafe copy after successful bounds validation
  • Preserve existing public method signatures and semantics

If the buffer is too short, the code now fails deterministically
instead of corrupting memory.

Impact

  • Prevents out-of-bounds writes from safe Rust APIs
  • Hardens generated mutation code against malformed or attacker-
    controlled buffers
  • No behavior change for valid buffers

Testing

  • Regenerated Rust test outputs to match the new codegen
  • Reasoned verification that all scalar writes now require a successful
    bounds-checked subslice before copying

This change is limited to Rust code generation and does not affect the
binary FlatBuffers format or APIs in other languages.

@google-cla
Copy link

google-cla bot commented Jan 9, 2026

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

@github-actions github-actions bot added c++ rust codegen Involving generating code from schema labels Jan 9, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

c++ codegen Involving generating code from schema rust

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant