Mutable unsafe aliasing of string data
low swesweep-fasthttp · fasthttputil/s2b.go · s2b · run #4
Description
s2b returns a []byte that aliases the immutable bytes of s without copying. The returned slice is mutable, so callers can write directly to string memory. If the slice is mutated, retained across goroutines, or used on shared/read-only/interned string data, it can corrupt process memory, corrupt shared values, or introduce data races. The slice length is bounded by len(s), so this is not a direct out-of-bounds write in this file, but it is a latent unsafe primitive that must be treated as read-only.
Triage
Not triaged.
Raw scan report for this file
The function `s2b` is a common zero-copy Go idiom for treating a `string` as a `[]byte`. It does not copy the string data, so it is fast and allocation-free.
Key observations:
1. **No direct out-of-bounds write from `len(s)`**
`unsafe.Slice(unsafe.StringData(s), len(s))` uses the exact length of the string. For a well-formed Go string, the backing data is at least `len(s)` bytes long, so the slice itself does not escape the string’s valid byte range.
2. **No obvious integer overflow**
The element type is `byte`, so the slice size is `len(s) * 1`. There is no multiplication that could overflow for a valid Go `string`.
3. **Empty-string handling is not clearly exploitable**
For an empty string, the result is a zero-length slice. In normal Go runtime behavior this does not require accessing valid bytes, so it is not a reliable denial-of-service vector in this file alone.
4. **Main security concern: mutable aliasing of immutable string data**
The returned `[]byte` appears mutable to callers, but it aliases the string’s backing bytes. If any caller writes through the slice, it mutates string memory. That can cause:
- corruption of shared, cached, or interned string data,
- writes to read-only memory and process crashes,
- data races if the alias is retained across goroutines,
- type confusion between immutable `string` and mutable `[]byte`.
Because `s` may come from attacker-controlled HTTP data when this helper is used internally by public FastHTTP APIs, any future or existing caller that mutates the returned slice could turn this into a real memory-corruption or DoS issue. However, this file itself does not perform the mutation, so the finding is latent rather than a directly triggerable OOB write.
```json
[
{
"severity": "low",
"title": "Mutable unsafe aliasing of string data",
"function": "s2b",
"description": "s2b returns a []byte that aliases the immutable bytes of s without copying. The returned slice is mutable, so callers can write directly to string memory. If the slice is mutated, retained across goroutines, or used on shared/read-only/interned string data, it can corrupt process memory, corrupt shared values, or introduce data races. The slice length is bounded by len(s), so this is not a direct out-of-bounds write in this file, but it is a latent unsafe primitive that must be treated as read-only."
}
]
```