Skip to content
This repository has been archived by the owner on Feb 18, 2024. It is now read-only.

Add miri checks against IO IPC to mitigate RUSTSEC-2020-0159 #592

Closed
jorgecarleitao opened this issue Nov 9, 2021 · 0 comments · Fixed by #595
Closed

Add miri checks against IO IPC to mitigate RUSTSEC-2020-0159 #592

jorgecarleitao opened this issue Nov 9, 2021 · 0 comments · Fixed by #595
Labels
no-changelog Issues whose changes are covered by a PR and thus should not be shown in the changelog testing PRs that only increase coverage

Comments

@jorgecarleitao
Copy link
Owner

I went through the code in arrow-format and this crate and could not find any incorrect usage. However, given the size of this exposure, I propose that we do not ignore this advisory until we have MIRI running against the IPC implementation.

The goal of this issue is to make MIRI run against the IO IPC, to safeguard us against RUSTSEC-2020-0159.

The blocker/challenge is that MIRI in isolation does not allow opening a file, and we do need to open IPC files to roundtrip them. We should try to lift the isolation constraint on the CI for MIRI to have it run against IPC roundtrip tests (tests::io::ipc::file::write should be sufficient).

@jorgecarleitao jorgecarleitao added the testing PRs that only increase coverage label Nov 9, 2021
@jorgecarleitao jorgecarleitao added the no-changelog Issues whose changes are covered by a PR and thus should not be shown in the changelog label Nov 10, 2021
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
no-changelog Issues whose changes are covered by a PR and thus should not be shown in the changelog testing PRs that only increase coverage
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant