3 results · Feed
-
Unscored —
Several memory corruption issues via safe APIs
Several soundness violations exist in the Rust bindings for `MetaCall`, indicatively: **`MetaCallException::Clone`**: `Clone` is dangerous because it creates a second Rust object that still points to the same foreign `MetaCall` value, but does not actually ow…
-
Unscored —
Bad-free in `MetaCallException::new`
`exception_struct` is a local stack variable, but the code passes its address to the C language as `&mut exception_struct as *mut _ as *mut c_void`. Then, the returned `MetaCallException` value is stored here: ```rust Ok(Self { exception_struct: Arc::new(exce…
-
Unscored —
Null-pointer dereference and double-free via safe APIs
Two soundness violations exist in the Rust bindings for MetaCall: **Null-pointer dereference:** `MetaCallFuture::new_raw()` accepts a raw pointer without validation. The `Debug` impl calls `Box::from_raw(self.data)` on it. Passing a null pointer causes the `D…