rust: fix OOB write in generated table scalar setters #8904
+68
−974
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
This patch fixes a memory-safety issue in Rust code generated by
flatcwhere table scalar setters and mutators could perform out-of-bounds
writes when operating on malformed or undersized buffers.
Vulnerability Details
Rust-generated table setters write scalar values directly into the
backing
&mut [u8]buffer using pointer copies without first verifyingthat the buffer is large enough for the write.
If a wrapper is constructed over a buffer shorter than
OFFSET + sizeof(T), calling a generatedset_*ormutate_*methodwould write past the end of the slice, causing undefined behavior and
memory corruption. Because these methods are safe (not
unsafe fn),this allows memory corruption from safe Rust code.
Fix
subslice using
get_mut(OFFSET..OFFSET+size)If the buffer is too short, the code now fails deterministically
instead of corrupting memory.
Impact
controlled buffers
Testing
bounds-checked subslice before copying
This change is limited to Rust code generation and does not affect the
binary FlatBuffers format or APIs in other languages.