Skip to content

[False Negative] Unsafe Dataflow checker misses bugs when logic is wrapped in a closure #69

@chisa22

Description

@chisa22

I found a false negative where Rudra fails to detect a panic safety bug (potential double-free) when the unsafe block is wrapped inside an immediately invoked closure.
When the logic is directly inside the function, Rudra correctly reports a warning. However, wrapping it in (|| { ... })() silences the detector.
Reproduction Code:

use std::ptr;
fn insertion_sort_unsafe<T: Ord>(arr: &mut [T]) {
    (|| {
    unsafe {
        for i in 1..arr.len() {
            let item = ptr::read(&arr[i]);
            let mut j = i - 1;
            while j >= 0 && arr[j] > item {
                j = j - 1;
            }
            ptr::copy(&mut arr[j + 1], &mut arr[j + 2], i - j - 1);
            ptr::write(&mut arr[j + 1], item);
        }
    }
})()
}
pub fn main() {
    let mut arr = [3, 2, 1];
    insertion_sort_unsafe(&mut arr);
}

Expected Behavior: Rudra should detect the UnsafeDataflow issue inside the closure, identifying ptr::read as the source and the generic comparison > as the potential panic sink.
Actual Behavior: No warning is reported.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions