Maybe unsound in IOBuff::Buf

[lwz23]

Hello, thank you for your contribution in this work. I'm scanning rust project for unsound problem.
I notice the following code.

pub struct IOBuff {
    pub addr: u64,
    pub size: usize,
}

impl IOBuff {
....................................
    pub fn Buf(&self) -> &'static mut [u8] {
        let ptr = self.addr as *mut u8;
        let toSlice = unsafe { slice::from_raw_parts_mut(ptr, self.size) };

        return toSlice;
    }
......................................
}

considering IOBuff is a pub struct and addr is a pub field, I;m not sure whether user can directlt create and assign addr field. And with the direct call to slice::from_raw_parts_mut(ptr, self.size) which may result in UB. I am not sure whether user can direct call the Buf method, if it is not for external using, maybe we should mark it as unsafe or pub(crate)? I brought this up for security reasons, so please don't mind if this is a false report.

[QuarkContainer]

Thank you for information. You understanding is correct. This is enginering debt.

[shrik3]

On Sat Dec 7, 2024 at 2:09 PM CET, lwz23 wrote: Hello, thank you for your contribution in this work. I'm scanning rust project for unsound problem. I notice the following code. ``` pub struct IOBuff { pub addr: u64, pub size: usize, } impl IOBuff { .................................... pub fn Buf(&self) -> &'static mut [u8] { let ptr = self.addr as *mut u8; let toSlice = unsafe { slice::from_raw_parts_mut(ptr, self.size) }; return toSlice; } ...................................... } ``` considering `IOBuff` is a `pub` struct and `addr` is a `pub` field, I;m not sure whether user can directlt create and assign `addr` field. And with the direct call to `slice::from_raw_parts_mut(ptr, self.size)` which may result in UB. I am not sure whether user can direct call the `Buf` method, if it is not for external using, maybe we should mark it as `unsafe` or `pub(crate)`? I brought this up for security reasons, so please don't mind if this is a false report.

in general you are right, Quark codebase has a lot of unsoundness due to early debts. But it doesn't hurt too much for now since we are not distributing a library, everything is considered "internal" for the devs. XD out-of-topic: it seems you are using some automatic tools to find this issue (and generate the report). This is interesting, mind sharing some insights? -- I'm sure there are more of such patterns in this codebase. Sorry if I make the wrong assumption.

…

-- wth 220F 6A50 7BEF 8C33 3B4A 4404 99DE B3B4 1583 4AEF

[SherlockShemol]

out-of-topic: it seems you are using some automatic tools to find this
issue (and generate the report). This is interesting, mind sharing some
insights? -- I'm sure there are more of such patterns in this codebase.

In his repository maybe this: https://github.com/lwz23/scan_overunsafe