Tonic's `encode_item` function is not exception safe, leading to use of uninitialized memory
Bug Report
Version
0.14.6
Platform
Linux
Crates
tonic
Description
Hello, we are security researchers targeting Rust security. By running our tool in this repository, we found a soundness issue. This report is written by 100% human. We promise that all you read will never be generated by LLM.
The problem happens here:
In line 149, buf.advance_mut is called to increase the length for header, and in line 178, finish_encoding is called to fill header bytes into the increased slots. However, in line 156 and line 173, Encoder::encode method is called, which is a user-provided trait method. If user deliberately call panic! inside encode function, finish_encoding will never be called, leading to buf exposing uninitialized variable.
To fix it, I think adding a drop guard to restore the length when unwinding could help.
Source: grpc/grpc-rust