Memory Safety Bugs in Rust Standard Library

Microsoft FORGE Lab researchers examined memory-safety flaws in Rust’s standard libraries, core and std, using the AI-assisted Hyenas scanner alongside manual investigation and proof-of-concept tests. Their findings show how safe Rust can still trigger undefined behavior when unsafe implementation details violate the guarantees of a safe API. The researchers group the bugs into three forms of misplaced trust: assuming code will not panic, assuming user-provided implementations behave correctly, and assuming the operating system or other external state remains trustworthy. They reported issues to Rust maintainers; some were fixed, while two remained open at publication.

One example involves a fixed-size buffer whose clone method calls user-defined code before initializing its contents. If that code panics, destruction accesses uninitialized memory; the fix prevents the incomplete buffer from being dropped during unwinding. Another flaw in string replacement trusted a custom pattern implementation to supply an ASCII byte, allowing it to corrupt UTF-8 and produce a string whose later use could cause undefined behavior. The discussion also notes related bugs involving repeated borrows and searcher results, and allocator methods that unwind, prompting a requirement that custom allocators not panic. Together, the cases illustrate why unsafe code must anticipate panics, validate trait-provided results, and carefully account for interactions with system state.