4 ms·
Fast memory vulnerabilities, written in 100% safe Rust
- N_Lens 10mo agoFunnily this is satire/educational code - notice the license is "GLWTPL" (Good Luck With That Public License). Repo is based on exploiting this bug - https://github.com/rust-lang/rust/issues/25860 https://github.com/rust-lang/rust/issues/25860 (Open since 2015) The bug allows you to "extend" any lifetime 'a to 'static in safe code: This converts a reference with any lifetime into a 'static reference, which violates Rust's safety guarantees. Once you can do this, you can create dangling references, access freed memory, etc. This is a type system bug, not just an implementation bug. From the discussions: - The easy fix (banning contravariance in function arguments) would eliminate valid Rust programs - The proper fix requires changes to how higher-ranked lifetime variables carry subtyping relations - The Rust team chose to pursue the more rigorous solution as part of replacing the trait solver (the "Chalk" project)