BudgetScan

Mutable unsafe aliasing of string data

low swesweep-fasthttp · fasthttputil/s2b.go · s2b · run #4

Description

s2b returns a []byte that aliases the immutable bytes of s without copying. The returned slice is mutable, so callers can write directly to string memory. If the slice is mutated, retained across goroutines, or used on shared/read-only/interned string data, it can corrupt process memory, corrupt shared values, or introduce data races. The slice length is bounded by len(s), so this is not a direct out-of-bounds write in this file, but it is a latent unsafe primitive that must be treated as read-only.

Triage

Not triaged.

Raw scan report for this file

The function `s2b` is a common zero-copy Go idiom for treating a `string` as a `[]byte`. It does not copy the string data, so it is fast and allocation-free.

Key observations:

1. **No direct out-of-bounds write from `len(s)`**  
   `unsafe.Slice(unsafe.StringData(s), len(s))` uses the exact length of the string. For a well-formed Go string, the backing data is at least `len(s)` bytes long, so the slice itself does not escape the string’s valid byte range.

2. **No obvious integer overflow**  
   The element type is `byte`, so the slice size is `len(s) * 1`. There is no multiplication that could overflow for a valid Go `string`.

3. **Empty-string handling is not clearly exploitable**  
   For an empty string, the result is a zero-length slice. In normal Go runtime behavior this does not require accessing valid bytes, so it is not a reliable denial-of-service vector in this file alone.

4. **Main security concern: mutable aliasing of immutable string data**  
   The returned `[]byte` appears mutable to callers, but it aliases the string’s backing bytes. If any caller writes through the slice, it mutates string memory. That can cause:
   - corruption of shared, cached, or interned string data,
   - writes to read-only memory and process crashes,
   - data races if the alias is retained across goroutines,
   - type confusion between immutable `string` and mutable `[]byte`.

   Because `s` may come from attacker-controlled HTTP data when this helper is used internally by public FastHTTP APIs, any future or existing caller that mutates the returned slice could turn this into a real memory-corruption or DoS issue. However, this file itself does not perform the mutation, so the finding is latent rather than a directly triggerable OOB write.

```json
[
  {
    "severity": "low",
    "title": "Mutable unsafe aliasing of string data",
    "function": "s2b",
    "description": "s2b returns a []byte that aliases the immutable bytes of s without copying. The returned slice is mutable, so callers can write directly to string memory. If the slice is mutated, retained across goroutines, or used on shared/read-only/interned string data, it can corrupt process memory, corrupt shared values, or introduce data races. The slice length is bounded by len(s), so this is not a direct out-of-bounds write in this file, but it is a latent unsafe primitive that must be treated as read-only."
  }
]
```