Microsoft’s AI bug hunter finds Rust flaw that went undetected for nearly 11 years

The first involved a panic-safety problem in Rust’s MapWindows::clone implementation. The function created a buffer before fully initializing its contents and then called a user-provided clone operation to populate it. If that operation triggered a panic, Rust’s unwinding mechanism could invoke the buffer’s destructor, which would attempt to access uninitialized memory. Microsoft said the reported fix prevents the partially initialized buffer from being destroyed before initialization is complete.

Another finding involved str::replace. The researchers found that the function could make an incorrect assumption about a custom implementation of the nightly Pattern trait. A custom implementation could supply a non-ASCII byte where the code expected an ASCII character, causing the replacement operation to produce invalid UTF-8 data. Subsequent string operations could then trigger undefined behavior, Microsoft said.

System-level bugs affect stable Rust

Microsoft said…