3 ms·
If you read the Github issue, this one was weaponized fairly straightforwardly by taking the difference between the two pointers. The difference is zero, but t
by tux3 1y ago
If you read the Github issue, this one was weaponized fairly straightforwardly by taking the difference between the two pointers.
The difference is zero, but the compiler thinks it is non-zero because it thinks they are unequal.
From there you turn it into type confusion through an array, and then whatever you want. Almost any wrong compiler assumption can be exploited. This particular way to do it has also been used several times to exploit bugs in Javscript engines.
- saghm 1y agoI did read through the issue, and reading through it again, I still see nothing about how a segfault can be generated from safe Rust. I'm not saying it can't happen from this bug, but it's not obvious to me what exact code I could write that could cause this to happen, because none of the examples in that issue seem to be doing that.
- tux3 1y agoHere it is extracted for you: https://play.rust-lang.org/?version=stable&mode=release&edition=2024&gist=bce23162d56467806fac8f0b4ad91b81 https://play.rust-lang.org/?version=stable&mode=release&edit... https://github.com/rust-lang/rust/issues/107975#issuecomment-1431996745 https://github.com/rust-lang/rust/issues/107975#issuecomment...