Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Unsound lifetime extension for DOM thread local #211

Open
Timbals opened this issue Feb 27, 2025 · 1 comment
Open

Unsound lifetime extension for DOM thread local #211

Timbals opened this issue Feb 27, 2025 · 1 comment

Comments

@Timbals
Copy link
Contributor

Timbals commented Feb 27, 2025

The documentation for LocalKey states

The with method yields a reference to the contained value which cannot outlive the current thread or escape the given closure.

The current dom context is stored in a thread local and its lifetime is extended beyond, and escapes, the closure

// SAFETY: Rust won't give us a 'static reference here because this
// thread could send the 'static value to another thread and then die
// prematurely. This would be bad.
//
// However, we have some good news! Ref<T> is not Send and never will
// be. We can rest assured that this reference will never outlive the
// thread it originated from.
let context = unsafe { extend_lifetime(context) };

In practice, this can lead to a use-after-free if the current dom is accessed in the destructor of another thread local.

This is similar to rust-random/rand#968, and they fixed it by wrapping the thread local in a std::rc::Rc.
That issue also links to a test case that actually produces a use-after-free on macOS which would also apply to Yakui.

@LPGhatguy
Copy link
Member

Cool, thank you for the note on this! I'm interested in fixing this.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants