Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Undefined behavior in test_negative_time_propagation #29

Open
icmccorm opened this issue Dec 5, 2023 · 0 comments
Open

Undefined behavior in test_negative_time_propagation #29

icmccorm opened this issue Dec 5, 2023 · 0 comments

Comments

@icmccorm
Copy link

icmccorm commented Dec 5, 2023

I've been experimenting with a version of Miri that can execute foreign functions by interpreting the LLVM bytecode that is produced during a crate's build process. We're hoping that our results can assist with the Krabcake project.

Miri found the following error in the test case tests::test_negative_time_propagation

---- Foreign Error Trace ----

@ store i8 95, ptr %80, align 1, !dbg !639

.../sgp4-rs/src/sgp4/sgp4io.cpp:102:19
src/sgp4_sys.rs:463:9: 474:10
-----------------------------

error: Undefined Behavior: attempting a write access using <102969> at alloc26549[0xf], but that tag only grants SharedReadOnly permission for this location
    |
    = note: attempting a write access using <102969> at alloc26549[0xf], but that tag only grants SharedReadOnly permission for this location
    = note: this error occurs as part of an access at alloc26549[0xf..0x10]
    = note: (no span available)
    = help: this indicates a potential bug in the program: it performed an invalid operation, but the Stacked Borrows rules it violated are still experimental
    = help: see https://github.com/rust-lang/unsafe-code-guidelines/blob/master/wip/stacked-borrows.md for further information
help: <102969> was created by a SharedReadOnly retag at offsets [0x0..0x46]
   --> src/sgp4_sys.rs:464:13
    |
464 |             l1.as_ptr(),
    |             ^^^^^^^^^^^

The pointer created by l1.as_ptr() has read-only permissions, but the C function twoline2rv mutates it.

  for (j = 10; j <= 15; j++)
    if (longstr1[j] == ' ')
      longstr1[j] = '_'

This seems like it would be non-trivial to fix, since l1 is an &str that's passed down through a constructor. Unless copying the string into a temporary variable would be a valid solution.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant