Skip to content

Commit 24ad421

Browse files
authored
[Rust] Fix UB for basic block analysis context out params (#7908)
1 parent cab23d9 commit 24ad421

1 file changed

Lines changed: 34 additions & 16 deletions

File tree

rust/src/architecture/basic_block.rs

Lines changed: 34 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -71,40 +71,58 @@ impl BasicBlockAnalysisContext {
7171
.zip(raw_contextual_return_vals.iter().copied())
7272
.collect();
7373

74-
let raw_direct_ref_sources: &[BNArchitectureAndAddress] =
75-
unsafe { std::slice::from_raw_parts(ctx_ref.directRefSources, ctx_ref.directRefCount) };
76-
let raw_direct_ref_targets: &[u64] =
77-
unsafe { std::slice::from_raw_parts(ctx_ref.directRefTargets, ctx_ref.directRefCount) };
74+
// The lists below this are out params and are possibly not initialized.
75+
let raw_direct_ref_sources: &[BNArchitectureAndAddress] = match ctx_ref
76+
.directRefSources
77+
.is_null()
78+
{
79+
true => &[],
80+
false => std::slice::from_raw_parts(ctx_ref.directRefSources, ctx_ref.directRefCount),
81+
};
82+
let raw_direct_ref_targets: &[u64] = match ctx_ref.directRefTargets.is_null() {
83+
true => &[],
84+
false => std::slice::from_raw_parts(ctx_ref.directRefTargets, ctx_ref.directRefCount),
85+
};
7886
let direct_code_references: HashMap<u64, Location> = raw_direct_ref_targets
7987
.iter()
8088
.copied()
8189
.zip(raw_direct_ref_sources.iter().map(Location::from))
8290
.collect();
8391

84-
let raw_direct_no_return_calls: &[BNArchitectureAndAddress] = std::slice::from_raw_parts(
85-
ctx_ref.directNoReturnCalls,
86-
ctx_ref.directNoReturnCallsCount,
87-
);
92+
let raw_direct_no_return_calls: &[BNArchitectureAndAddress] =
93+
match ctx_ref.directNoReturnCalls.is_null() {
94+
true => &[],
95+
false => std::slice::from_raw_parts(
96+
ctx_ref.directNoReturnCalls,
97+
ctx_ref.directNoReturnCallsCount,
98+
),
99+
};
88100
let direct_no_return_calls: HashSet<Location> = raw_direct_no_return_calls
89101
.iter()
90102
.map(Location::from)
91103
.collect();
92104

93105
let raw_halted_disassembly_address: &[BNArchitectureAndAddress] =
94-
std::slice::from_raw_parts(
95-
ctx_ref.haltedDisassemblyAddresses,
96-
ctx_ref.haltedDisassemblyAddressesCount,
97-
);
106+
match ctx_ref.haltedDisassemblyAddresses.is_null() {
107+
true => &[],
108+
false => std::slice::from_raw_parts(
109+
ctx_ref.haltedDisassemblyAddresses,
110+
ctx_ref.haltedDisassemblyAddressesCount,
111+
),
112+
};
98113
let halted_disassembly_addresses: HashSet<Location> = raw_halted_disassembly_address
99114
.iter()
100115
.map(Location::from)
101116
.collect();
102117

103118
let raw_inlined_unresolved_indirect_branches: &[BNArchitectureAndAddress] =
104-
std::slice::from_raw_parts(
105-
ctx_ref.inlinedUnresolvedIndirectBranches,
106-
ctx_ref.inlinedUnresolvedIndirectBranchCount,
107-
);
119+
match ctx_ref.inlinedUnresolvedIndirectBranches.is_null() {
120+
true => &[],
121+
false => std::slice::from_raw_parts(
122+
ctx_ref.inlinedUnresolvedIndirectBranches,
123+
ctx_ref.inlinedUnresolvedIndirectBranchCount,
124+
),
125+
};
108126
let inlined_unresolved_indirect_branches: HashSet<Location> =
109127
raw_inlined_unresolved_indirect_branches
110128
.iter()

0 commit comments

Comments
 (0)