#2720·grpc-rust

Tonic's `encode_item` function is not exception safe, leading to use of uninitialized memory

Author: Evian-ZhangCreated Jul 5, 2026Updated Sep 16, 2026

Bug Report

Version

0.14.6

Platform

Linux

Crates

tonic

Description

Hello, we are security researchers targeting Rust security. By running our tool in this repository, we found a soundness issue. This report is written by 100% human. We promise that all you read will never be generated by LLM.

The problem happens here:

https://github.com/grpc/grpc-rust/blob/b68df9ff58eb8e4fc402ba2f0c3f6f56e1e5ead0/tonic/src/codec/encode.rs#L133-L179

In line 149, buf.advance_mut is called to increase the length for header, and in line 178, finish_encoding is called to fill header bytes into the increased slots. However, in line 156 and line 173, Encoder::encode method is called, which is a user-provided trait method. If user deliberately call panic! inside encode function, finish_encoding will never be called, leading to buf exposing uninitialized variable.

To fix it, I think adding a drop guard to restore the length when unwinding could help.