Potential unsoundness: OOB

[xizheyin]

Hello, thank you for your crate! My team is developing a static analyzer to check Safe Rust code that may trigger UBs. After downloading the repo from crates.io, we ran our checker and received warnings, leading us to construct cases that can trigger UB in safe code.

I've discovered a potential vulnerability that could cause an out-of-bounds access in the safe code.

use data_bucket::persistence::data::rkyv_data::parse_archived_row;

fn main() {
    // Safe API: data_length depends on columns, but buf can be shorter.
    // With an empty buffer and a non-empty schema, start_pointer underflows.
    let buf: Vec<u8> = Vec::new();
    let _ = parse_archived_row(&buf, &[("col", "String")]);
}

miri outputs:

error: Undefined Behavior: in-bounds pointer arithmetic failed: attempting to offset pointer by -8 bytes, but got 0x1[noalloc] which is a dangling pointer (it has no provenance)
  --> /Users/yxz/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/data_bucket-0.3.10/src/persistence/data/rkyv_data.rs:22:34
   |
22 |     let start_pointer = unsafe { buf.as_ptr().add(buf.len()).sub(data_length) };
   |                                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Undefined Behavior occurred here
   |
   = help: this indicates a bug in the program: it performed an invalid operation, and caused Undefined Behavior
   = help: see https://doc.rust-lang.org/nightly/reference/behavior-considered-undefined.html for further information
   = note: stack backtrace:
           0: data_bucket::persistence::data::rkyv_data::parse_archived_row::<&str, &str>
               at /Users/yxz/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/data_bucket-0.3.10/src/persistence/data/rkyv_data.rs:22:34: 22:78
           1: main
               at src/main.rs:7:13: 7:59

note: some details are omitted, run with `MIRIFLAGS=-Zmiri-backtrace=full` for a verbose backtrace

error: aborting due to 1 previous error

[djkoloski]

Anything that uses rkyv needs to be run with -Zmiri-tree-borrows.

[xizheyin]

I reran under Tree Borrows (MIRIFLAGS='-Zmiri-tree-borrows') and got the same UB.🤔

xxx@macbookpro 0148 % MIRIFLAGS='-Zmiri-tree-borrows' cargo +nightly miri run
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 0.10s
     Running `/Users/xxx/.rustup/toolchains/nightly-aarch64-apple-darwin/bin/cargo-miri runner target/miri/aarch64-apple-darwin/debug/repro-data_bucket-0148`
error: Undefined Behavior: in-bounds pointer arithmetic failed: attempting to offset pointer by -8 bytes, but got 0x1[noalloc] which is a dangling pointer (it has no provenance)
  --> /Users/yxz/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/data_bucket-0.3.10/src/persistence/data/rkyv_data.rs:22:34
   |
22 |     let start_pointer = unsafe { buf.as_ptr().add(buf.len()).sub(data_length) };
   |                                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Undefined Behavior occurred here
   |

[djkoloski]

Looks like they're missing a check that buf.len() - data_len >= 0 in their unsafe code

[yaokunzhang]

Hello!Is it okay to report this to RustSec? I'm happy to handle the PR