security-audits/viceroy/010-invalid-store-handle-can-panic-hostcall.patch at main · Swival/security-audits · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
diff --git a/src/wiggle_abi/kv_store_impl.rs b/src/wiggle_abi/kv_store_impl.rs
index 4ce94cb..938228e 100644
--- a/src/wiggle_abi/kv_store_impl.rs
+++ b/src/wiggle_abi/kv_store_impl.rs
@@ -8,7 +8,7 @@ use crate::session::{

 use {
     crate::{
-        error::Error,
+        error::{Error, HandleError},
         object_store::{ObjectKey, ObjectStoreError},
         session::Session,
         wiggle_abi::{
@@ -49,7 +49,11 @@ impl FastlyKvStore for Session {
         _lookup_configuration: GuestPtr<KvLookupConfig>,
         handle_out: GuestPtr<KvStoreLookupHandle>,
     ) -> Result<(), Error> {
-        let store = self.get_kv_store_key(store).unwrap();
+        let store = self
+            .get_kv_store_key(store)
+            .ok_or(Error::HandleError(HandleError::InvalidObjectStoreHandle(
+                store.into(),
+            )))?;
         let key = ObjectKey::new(memory.as_str(key)?.ok_or(Error::SharedMemory)?.to_string())
             .map_err(|_| KvStoreError::BadRequest)?;
         // just create a future that's already ready
@@ -183,7 +187,12 @@ impl FastlyKvStore for Session {
         insert_configuration: GuestPtr<KvInsertConfig>,
         pending_handle_out: GuestPtr<KvStoreInsertHandle>,
     ) -> Result<(), Error> {
-        let store = self.get_kv_store_key(store).unwrap().clone();
+        let store = self
+            .get_kv_store_key(store)
+            .ok_or(Error::HandleError(HandleError::InvalidObjectStoreHandle(
+                store.into(),
+            )))?
+            .clone();
         let key = ObjectKey::new(memory.as_str(key)?.ok_or(Error::SharedMemory)?.to_string())
             .map_err(|_| KvStoreError::BadRequest)?;
         let body = self.take_body(body_handle)?.read_into_vec().await?;
@@ -275,7 +284,12 @@ impl FastlyKvStore for Session {
         _delete_configuration: GuestPtr<KvDeleteConfig>,
         pending_handle_out: GuestPtr<KvStoreDeleteHandle>,
     ) -> Result<(), Error> {
-        let store = self.get_kv_store_key(store).unwrap().clone();
+        let store = self
+            .get_kv_store_key(store)
+            .ok_or(Error::HandleError(HandleError::InvalidObjectStoreHandle(
+                store.into(),
+            )))?
+            .clone();
         let key = ObjectKey::new(memory.as_str(key)?.ok_or(Error::SharedMemory)?.to_string())
             .map_err(|_| KvStoreError::BadRequest)?;
         let fut = futures::future::ok(self.kv_delete(store, key));
@@ -320,7 +334,12 @@ impl FastlyKvStore for Session {
         list_configuration: GuestPtr<KvListConfig>,
         pending_handle_out: GuestPtr<KvStoreListHandle>,
     ) -> Result<(), Error> {
-        let store = self.get_kv_store_key(store).unwrap().clone();
+        let store = self
+            .get_kv_store_key(store)
+            .ok_or(Error::HandleError(HandleError::InvalidObjectStoreHandle(
+                store.into(),
+            )))?
+            .clone();

         let config = memory.read(list_configuration)?;