Thanks for your crate! My team is developing a static analyzer to check Safe Rust code that may trigger UBs. After downloading the repo from crates.io, we ran our checker and received warnings, leading us to construct cases that can trigger UB in safe code.
I've discovered a potential unsoundness—the example below causes an out-of-bounds error when using a public safe function.
use rblas::math::Mat;
fn main() {
// 1x1 matrix
let a: Mat<u8> = Mat::fill(0u8, 1, 1);
// Trigger the vulnerable path: Mat<T>::Index<usize> (row indexing).
// Use an out-of-bounds row index to force unchecked pointer offset and slice creation.
// This is UB and should be caught by Miri (causing non-zero exit).
let row = &a[1];
// Force a concrete read from the invalid slice.
std::hint::black_box(row[0]);
}
miri outputs:
error: Undefined Behavior: pointer not dereferenceable: pointer must be dereferenceable for 1 byte, but got alloc284+0x1 which is at or beyond the end of the allocation of size 1 byte
--> src/main.rs:10:17
|
10 | let row = &a[1];
| ^^^ Undefined Behavior occurred here
|
= help: this indicates a bug in the program: it performed an invalid operation, and caused Undefined Behavior
= help: see https://doc.rust-lang.org/nightly/reference/behavior-considered-undefined.html for further information
help: alloc284 was allocated here:
--> src/main.rs:5:22
|
5 | let a: Mat<u8> = Mat::fill(0u8, 1, 1);
| ^^^^^^^^^^^^^^^^^^^^
note: some details are omitted, run with `MIRIFLAGS=-Zmiri-backtrace=full` for a verbose backtrace
error: aborting due to 1 previous error
Thanks for your crate! My team is developing a static analyzer to check Safe Rust code that may trigger UBs. After downloading the repo from crates.io, we ran our checker and received warnings, leading us to construct cases that can trigger UB in safe code.
I've discovered a potential unsoundness—the example below causes an out-of-bounds error when using a public safe function.
miri outputs: