Skip to content

Potential Unsoundness: OOB UB #27

@xizheyin

Description

@xizheyin

Thanks for your crate! My team is developing a static analyzer to check Safe Rust code that may trigger UBs. After downloading the repo from crates.io, we ran our checker and received warnings, leading us to construct cases that can trigger UB in safe code.

I've discovered a potential unsoundness—the example below causes an out-of-bounds error when using a public safe function.

use rblas::math::Mat;

fn main() {
    // 1x1 matrix
    let a: Mat<u8> = Mat::fill(0u8, 1, 1);

    // Trigger the vulnerable path: Mat<T>::Index<usize> (row indexing).
    // Use an out-of-bounds row index to force unchecked pointer offset and slice creation.
    // This is UB and should be caught by Miri (causing non-zero exit).
    let row = &a[1];

    // Force a concrete read from the invalid slice.
    std::hint::black_box(row[0]);
}

miri outputs:

error: Undefined Behavior: pointer not dereferenceable: pointer must be dereferenceable for 1 byte, but got alloc284+0x1 which is at or beyond the end of the allocation of size 1 byte
  --> src/main.rs:10:17
   |
10 |     let row = &a[1];
   |                 ^^^ Undefined Behavior occurred here
   |
   = help: this indicates a bug in the program: it performed an invalid operation, and caused Undefined Behavior
   = help: see https://doc.rust-lang.org/nightly/reference/behavior-considered-undefined.html for further information
help: alloc284 was allocated here:
  --> src/main.rs:5:22
   |
 5 |     let a: Mat<u8> = Mat::fill(0u8, 1, 1);
   |                      ^^^^^^^^^^^^^^^^^^^^

note: some details are omitted, run with `MIRIFLAGS=-Zmiri-backtrace=full` for a verbose backtrace

error: aborting due to 1 previous error

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions