0056-gfwx.rs

/*!
```rudra-poc
[target]
crate = "gfwx"
version = "0.3.0"

[[target.peer]]
crate = "crossbeam-utils"
version = "0.8.0"

[report]
issue_url = "https://github.com/Devolutions/gfwx-rs/issues/7"
issue_date = 2020-12-08
rustsec_url = "https://github.com/RustSec/advisory-db/pull/610"
rustsec_id = "RUSTSEC-2020-0104"

[[bugs]]
analyzer = "SendSyncVariance"
bug_class = "SendSyncVariance"
bug_count = 2
rudra_report_locations = [
    "src/processing/image.rs:160:1: 160:48",
    "src/processing/image.rs:161:1: 161:48",
]
```
!*/
#![forbid(unsafe_code)]

use gfwx::processing::image::Image;

use crossbeam_utils::thread;
use std::cell::Cell;

// A simple tagged union used to demonstrate problems with data races in Cell.
#[derive(Debug, Clone, Copy)]
enum RefOrInt {
    Ref(&'static u64),
    Int(u64),
}
static SOME_INT: u64 = 123;

fn main() {
    let cell = Cell::new(RefOrInt::Ref(&SOME_INT));
    let slice = &mut [&cell];

    let image = Image::from_slice(slice, (1, 1), 1);

    let mut chunk_iterator = image.into_chunks_mut(1, 1);
    let image_chunk = chunk_iterator.next().unwrap();

    thread::scope(|s| {
        s.spawn(|_| {
            let smuggled_cell = image_chunk[(0, 0)];

            loop {
                // Repeatedly write Ref(&addr) and Int(0xdeadbeef) into the cell.
                smuggled_cell.set(RefOrInt::Ref(&SOME_INT));
                smuggled_cell.set(RefOrInt::Int(0xdeadbeef));
            }
        });

        loop {
            if let RefOrInt::Ref(addr) = cell.get() {
                // Hope that between the time we pattern match the object as a
                // `Ref`, it gets written to by the other thread.
                if addr as *const u64 == &SOME_INT as *const u64 {
                    continue;
                }

                println!("Pointer is now: {:p}", addr);
                println!("Dereferencing addr will now segfault: {}", *addr);
            }
        }
    });
}