Skip to content

UB in SpringConfig #60

Closed
Closed
@laysakura

Description

@laysakura

Describe the bug

MIRI detected UBs at least in SpringConfig.

To Reproduce

Steps to reproduce the behavior:

  1. Write the code below in lib.rs.
#[test]
fn test_spring_config_default() {
    unsafe {
        let config = spring_config_default();
        assert!(!config.is_null());
        spring_config_close(config);
    }
}
  1. Install MIRI.
rustup +nightly-2022-06-14 component add miri
cargo +nightly-2022-06-14 miri test
  1. Run the test with MIRI.
cargo +nightly-2022-06-14 miri test
  1. Got the following errors:
running 3 tests
test tests::spring_config::test_spring_config_default ... ok
test tests::spring_config::test_spring_config_toml ... ok
test tests::spring_source_row_builder::test_spring_source_row_builder ... error: Undefined Behavior: incorrect layout on deallocation: alloc2276582 has size 40 and alignment 8, but gave size 1 and alignment 1
   --> /Users/sho.nakatani/.rustup/toolchains/nightly-2022-06-14-aarch64-apple-darwin/lib/rustlib/src/rust/library/alloc/src/alloc.rs:107:14
    |
107 |     unsafe { __rust_dealloc(ptr, layout.size(), layout.align()) }
    |              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ incorrect layout on deallocation: alloc2276582 has size 40 and alignment 8, but gave size 1 and alignment 1
    |
    = help: this indicates a bug in the program: it performed an invalid operation, and caused Undefined Behavior
    = help: see https://doc.rust-lang.org/nightly/reference/behavior-considered-undefined.html for further information
            
    = note: inside `std::alloc::dealloc` at /Users/sho.nakatani/.rustup/toolchains/nightly-2022-06-14-aarch64-apple-darwin/lib/rustlib/src/rust/library/alloc/src/alloc.rs:107:14
    = note: inside `<std::alloc::Global as std::alloc::Allocator>::deallocate` at /Users/sho.nakatani/.rustup/toolchains/nightly-2022-06-14-aarch64-apple-darwin/lib/rustlib/src/rust/library/alloc/src/alloc.rs:244:22
    = note: inside `alloc::alloc::box_free::<std::ffi::c_void, std::alloc::Global>` at /Users/sho.nakatani/.rustup/toolchains/nightly-2022-06-14-aarch64-apple-darwin/lib/rustlib/src/rust/library/alloc/src/alloc.rs:342:9
    = note: inside `std::ptr::drop_in_place::<std::boxed::Box<std::ffi::c_void>> - shim(Some(std::boxed::Box<std::ffi::c_void>))` at /Users/sho.nakatani/.rustup/toolchains/nightly-2022-06-14-aarch64-apple-darwin/lib/rustlib/src/rust/library/core/src/ptr/mod.rs:487:1
    = note: inside `std::mem::drop::<std::boxed::Box<std::ffi::c_void>>` at /Users/sho.nakatani/.rustup/toolchains/nightly-2022-06-14-aarch64-apple-darwin/lib/rustlib/src/rust/library/core/src/mem/mod.rs:974:24
note: inside `spring_source_row::SpringSourceRow::drop` at src/spring_source_row.rs:24:9
   --> src/spring_source_row.rs:24:9
    |
24  |         drop(inner);
    |         ^^^^^^^^^^^
note: inside `spring_source_row_close` at src/lib.rs:344:9
   --> src/lib.rs:344:9
    |
344 |         SpringSourceRow::drop(row);
    |         ^^^^^^^^^^^^^^^^^^^^^^^^^^
note: inside `tests::spring_source_row_builder::test_spring_source_row_builder` at src/tests/spring_source_row_builder.rs:23:9
   --> src/tests/spring_source_row_builder.rs:23:9
    |
23  |         spring_source_row_close(row);
    |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
note: inside closure at src/tests/spring_source_row_builder.rs:8:1
   --> src/tests/spring_source_row_builder.rs:8:1
    |
7   |   #[test]
    |   ------- in this procedural macro expansion
8   | / fn test_spring_source_row_builder() {
9   | |     unsafe {
10  | |         let c1_col = CString::new("c1").unwrap();
11  | |         let c1_value = vec![0x01, 0x02, 0x03];
...   |
24  | |     }
25  | | }
    | |_^
    = note: this error originates in the attribute macro `test` (in Nightly builds, run with -Z macro-backtrace for more info)

note: some details are omitted, run with `MIRIFLAGS=-Zmiri-backtrace=full` for a verbose backtrace

error: aborting due to previous error

error: test failed, to rerun pass '--lib'

Expected behavior

cargo miri exits with status code 0.

Environment

SpringQL-client-c

  • Version: v0.16.0+3

your machine

  • Device: e.g. MacBook Pro (M1)
  • OS: macOS

Additional context

We detected memory leak in a C app.

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions