Stream callback procedure is not unwind safe
Phosphorus15 opened this issue · comments
It is observed that the stream_callback
and stream_finished_callback
functions are not unwind safe, as their definitions shown below.
let mut stream_data: Box<StreamUserData<I, O>> = unsafe { mem::transmute(user_data) };
...
let result = match stream_data.callback
{
Some(ref mut f) => (*f)(input_buffer, output_buffer, timeinfo, flags),
None => StreamCallbackResult::Abort,
};
mem::forget(stream_data);
If the user-provided closure could possibly panic, the mem::forget
of boxed StreamUserData
would not be reachable, which causes its memory to be deallocated, thus resulting in an use after free
.
Since the StreamUserData
contains two function pointers which might be executed later-on, it is obvious that an arbitrary code execution can be constructed maliciously by this way. Therefore, this is highly-vulnerable and should be fixed.
Resolved in #21
Thank you for the report! 👍