Papers for

rust library developers

Papers whose findings have a practical use for this group, as judged from the abstract. Open a paper to read what it means in practice.

UnsafeChecker detects hidden safety bugs in Rust libraries

UnsafeChecker: Finding Soundness Bugs in Rust Safe Abstractions

Abstract: Rust guarantees memory safety without garbage collection through a strict ownership and borrowing system. However, for low-level systems programming, many widely used libraries rely on the unsafe keyword. These libraries encapsulate raw-pointer operations behind safe APIs to form safe abstractions. A single mistake in this internal unsafe code can break its safety contract, rendering the abstraction unsound and allowing safe clients to trigger undefined behavior. Detecting these potential soundness violations is challenging. Existing static analysis tools for C/C++ ignore Rust-specific safety contracts, while current Rust tools lack the deep semantic modeling required to track the contexts that raw pointers erase. To address this gap, we present UnsafeChecker, a compiler-integrated static analysis framework for detecting potential soundness violations in Rust safe abstractions. UnsafeChecker analyzes Rust MIR using a flow-sensitive abstract interpretation that maintains a shared state with three components: ownership, object validity, and layout. Each warning rule consumes the subset of facts needed for the corresponding Rust safety obligation. UnsafeChecker reports both instruction-level undefined behavior and boundary-level contract violations that may escape through safe APIs. We evaluate UnsafeChecker on a benchmark of 46 RustSec vulnerabilities, which contain 53 ground-truth bugs. UnsafeChecker outperforms several state-of-the-art tools, detecting 32 CVEs and covering 36 bugs (67.9% recall) with 51.6% alert-level precision. Furthermore, in a large-scale scan of real-world crates on crates.io, UnsafeChecker uncovered 114 previously unknown bugs across 83 crates, with 45 confirmed and 27 already fixed by maintainers.

Wed 9 SeptProgramming Languages
The gist
Rust promises safe memory management, but some Rust libraries use risky 'unsafe' code hidden inside safe interfaces, which can cause subtle bugs. The authors developed UnsafeChecker, a tool that scans Rust programs to find these hidden mistakes before they cause problems. Their tool checks how Rust tracks ownership and memory safety at a deep level to catch bugs that other tools miss. UnsafeChecker found many real bugs in widely used Rust code, helping programmers make safer software.
Open → 2609.09641v1