You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
On Linux, sigset_t is defined as a 1024-bit struct whereas only its first 64 bits are used. The sigemptyset function leaves the other 960 bits uninitialized.
The derived implementation of PartialEq for sigset_t naively compares all the bits of the struct and wrongly returns false depending on the uninitialized part.
tgross35
added
I-unsound 💥
A soundness hole (worst kind of bug), see: https://en.wikipedia.org/wiki/Soundness
and removed
I-unsound 💥
A soundness hole (worst kind of bug), see: https://en.wikipedia.org/wiki/Soundness
labels
Aug 29, 2024
Wait, this isn't actually unsound on libc's side. The example is incorrectly assuming that sigemptyset initializes the whole struct, which is no good when you assume_init - bad assumption :)
I am going to close this since there isn't something to be done for this specific issue. However, we are considering removing these traits in 1.0 to avoid this kind of footgun. This is being tracked at #3880, feel free to add any comments.
On Linux, sigset_t is defined as a 1024-bit struct whereas only its first 64 bits are used. The sigemptyset function leaves the other 960 bits uninitialized.
The derived implementation of PartialEq for sigset_t naively compares all the bits of the struct and wrongly returns false depending on the uninitialized part.
The text was updated successfully, but these errors were encountered: