> Look for any recursive function calls and see if they could be abused to overflow the stack.
This isn't an exploitable vulnerability in Rust, though? I thought the program would just abort if it overflowed the stack.
This isn't an exploitable vulnerability in Rust, though? I thought the program would just abort if it overflowed the stack.
let huge_ary: [u8; 2097152 /* 2MiB */] = unsafe { ::std::mem::uninitialized() };
// hopefully huge_ary has bumped the stack pointer past any guard pages
// and any further stack values will overwrite the heap let huge_ary: [u8; 2097152];
if false_value_compiler_cant_prove_is_false {
huge_ary = [0; 2097152];
}
// hopefully huge_ary has reserved space on the stack despite not being initialized
// and so any further stack values would overwrite the heapThen again, 2Mb is nothing on a 64 bit processor, so I don't think the chanse of hitting the heap is very big.
The 2Mib was assuming you've already pushed the stack to its limit and are sitting just above the guard page(s). You could replace that with whatever size you think is appropriate.
error[E0381]: borrow of possibly uninitialized variable: `huge_ary`
--> src/main.rs:6:7
|
6 | bar(&huge_ary);
| ^^^^^^^^^ use of possibly uninitialized `huge_ary`