Skip to content

[medium] [runtime] integer overflow in runtime/src/storage/iouring.rs #3288

@dnkolegov-ar

Description

@dnkolegov-ar

runtime/src/storage/iouring.rs derives per-operation offsets with unchecked u64 arithmetic. If a caller can supply an offset near u64::MAX, these additions can wrap on subsequent loop iterations (short read/write), redirecting I/O to unintended earlier positions:

  • let offset = offset + bytes_read as u64; [1]

  • offset += op_bytes_written as u64; in single-buffer write (runtime/src/storage/iouring.rs:324) [2]

  • offset += op_bytes_written as u64; in vectored write [3]

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    Status

    Backlog

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions