A large byte length can overflow to zero and still be used as the slice length.
That's targeting riscv32im-risc0-zkvm-elf where the implementations of std::env::args_os() and std::env::var_os() trust the host length. The code can allocate zero words and then build a huge
slice from that pointer.
Ideally we should panic instead of overflowing to avoid any huge allocation
|
let nwords = (nbytes + WORD_SIZE - 1) / WORD_SIZE; |
|
let words = unsafe { abi::sys_alloc_words(nwords) }; |
|
let arg_len_words = (arg_len + WORD_SIZE - 1) / WORD_SIZE; |
A large byte length can overflow to zero and still be used as the slice length.
That's targeting
riscv32im-risc0-zkvm-elfwhere the implementations ofstd::env::args_os()andstd::env::var_os()trust the host length. The code can allocate zero words and then build a hugeslice from that pointer.
Ideally we should panic instead of overflowing to avoid any huge allocation
rust/library/std/src/sys/env/zkvm.rs
Lines 18 to 19 in 98594f4
rust/library/std/src/sys/args/zkvm.rs
Line 19 in 98594f4