Scope API is unsound

[jonas-schievink]

Scope::new takes 2 *mut Option<_> parameters, but the rest of the Scope API assumes that those raw pointers are valid. For example, the public get_yield method does the following:

let para = unsafe { &mut *self.para };
para.take()

Calling Scope::new with invalid (null, misaligned or dangling) pointers is possible in safe Rust, and get_yield can also be called from safe Rust, therefore this API is unsound.

Either Scope::new should be marked unsafe, or it should take &'a mut Option<_> instead of raw pointers, adding a lifetime parameter to Scope.

[Xudong-Huang]

thanks for the advise. I just remove the unsafe get_scope and add scoped_init API

[Xudong-Huang]

I think this can be closed. It's all in 0.6.12

[Shnatsel]

Accessing a dangling pointer is usually an exploitable vulnerability. Please file a security advisory at https://github.com/RustSec/advisory-db so that users of this crate can check if they're running a vulnerable version and upgrade.

Also, please consider yanking affected versions.

[Xudong-Huang]

Thanks for the info. I will do it in next release.