Critical Rust memory safety bug: returning pointer to stack-allocated PMTEntry #894

New Issue

claunia · 2026-01-29T16:56:24Z

claunia commented

2026-01-29 16:56:24 +00:00

Originally created by @THE-Amrit-mahto-05 on GitHub (Jan 6, 2026).

Description

While reviewing the Rust FFI layer, I found a use-after-scope (dangling pointer) bug in ctorust.rs.

An implementation of FromCType<*mut PMT_entry> returns a raw pointer derived from a stack-allocated Rust value, which becomes invalid immediately after the function returns.

This is undefined behavior in Rust, independent of C-side invariants, test coverage, or calling order.

Affected File: src/rust/src/ctorust.rs

Problematic Code

let mut pmt_entry = PMTEntry {
    program_number,
    elementary_pid,
    stream_type,
    printable_stream_type,
};

Some(&mut pmt_entry as *mut PMTEntry)

here

pmt_entry is allocated on the stack
A pointer to it is returned
The function returns
The stack frame is destroyed
The returned pointer now points to invalid memory

Proposed Fix

let pmt_entry = PMTEntry { ... };
Some(Box::into_raw(Box::new(pmt_entry)))

Originally created by @THE-Amrit-mahto-05 on GitHub (Jan 6, 2026). ### Description While reviewing the Rust FFI layer, I found a use-after-scope (dangling pointer) bug in ctorust.rs. An implementation of FromCType<*mut PMT_entry> returns a raw pointer derived from a stack-allocated Rust value, which becomes invalid immediately after the function returns. This is undefined behavior in Rust, independent of C-side invariants, test coverage, or calling order. Affected File: src/rust/src/ctorust.rs ### Problematic Code ```rust let mut pmt_entry = PMTEntry { program_number, elementary_pid, stream_type, printable_stream_type, }; Some(&mut pmt_entry as *mut PMTEntry) ``` here - pmt_entry is allocated on the stack - A pointer to it is returned - The function returns - The stack frame is destroyed - The returned pointer now points to invalid memory ### Proposed Fix ```rust let pmt_entry = PMTEntry { ... }; Some(Box::into_raw(Box::new(pmt_entry))) ```

claunia closed this issue

2026-01-29 16:56:24 +00:00

claunia commented

2026-01-29 16:56:25 +00:00

@cfsmp3 commented on GitHub (Jan 8, 2026):

Please don't open a ticket for these things - PRs are OK, but issues are for users to report problems. If a developer sees a problem he/she just sends a PR.

@cfsmp3 commented on GitHub (Jan 8, 2026): Please don't open a ticket for these things - PRs are OK, but issues are for users to report problems. If a developer sees a problem he/she just sends a PR.

claunia referenced this issue

2026-01-29 17:18:14 +00:00

[PR #894] [MERGED] [IMPROVEMENT] Upgrade libgpac based on Hori75's branch #1734

claunia referenced this issue

2026-01-29 17:20:17 +00:00

[PR #1328] [MERGED] [IMPROVEMENT] Update GPAC to version 1.0.1 #2100

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/ccextractor#894