You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Hello fellow Rustacean,
we (Rust group @sslab-gatech) found a memory-safety/soundness issue in this crate while scanning Rust code on crates.io for potential vulnerabilities.
Device and DeviceHandle implement Send and Sync trait for all T types that implement UsbContext. UsbContext trait has neither Send nor Sync bound and can be implemented from the user side. This permits writing a custom non-thread safe UsbContext implementation in safe Rust code, which can cause a data race when used with Device or DeviceHandle.
If UsbContext is not expected to be implemented by users, making UsbContexta sealed trait can solve this problem. Otherwise, a proper bound should be added to Send/Sync implementations of Device and DeviceHandle (<T: Send/Sync + UsbContext>) or to the definition of UsbContext (UsbContext: Send + Sync).
The text was updated successfully, but these errors were encountered:
As mention #44 UsbContext trait has neither Send nor Sync bound and can be implemented from the user side. This permits writing a custom non-thread safe UsbContext implementation in safe Rust code, which can cause a data race when used with Device or DeviceHandle.
So required UsbContext implement Send + Sync
Hello fellow Rustacean,
we (Rust group @sslab-gatech) found a memory-safety/soundness issue in this crate while scanning Rust code on crates.io for potential vulnerabilities.
Issue Description
rusb/src/device.rs
Lines 34 to 35 in 12ee91d
rusb/src/device_handle.rs
Lines 127 to 128 in 12ee91d
Device
andDeviceHandle
implementSend
andSync
trait for allT
types that implementUsbContext
.UsbContext
trait has neitherSend
norSync
bound and can be implemented from the user side. This permits writing a custom non-thread safeUsbContext
implementation in safe Rust code, which can cause a data race when used withDevice
orDeviceHandle
.If
UsbContext
is not expected to be implemented by users, makingUsbContext
a sealed trait can solve this problem. Otherwise, a proper bound should be added to Send/Sync implementations ofDevice
andDeviceHandle
(<T: Send/Sync + UsbContext>
) or to the definition ofUsbContext
(UsbContext: Send + Sync
).The text was updated successfully, but these errors were encountered: