Soundness: Undefined Behavior in UnixDatagram::bind due to the use of mem::uninitialized()

[lewismosciski]

Hi there!

We scanned the most popular libraries on crates.io and found some memory safety bugs in this library.

To fix this soundness hole, mem::uninitialized() should be replaced with mem::MaybeUninit.

PoC

use mio_uds::UnixDatagram;
use std::path::PathBuf;

fn main() {
    // Any path triggers the UB: UnixDatagram::bind -> sockaddr_un() -> sun_path_offset()
    // -> mem::uninitialized::<libc::sockaddr_un>().
    let path: PathBuf = "/tmp/mio_uds_uninit_ub.sock".into();
    let _ = std::fs::remove_file(&path);
    let _ = UnixDatagram::bind(&path);
    let _ = std::fs::remove_file(&path);
}

Miri Output

error: Undefined Behavior: constructing invalid value at .sun_family: encountered uninitialized memory, but expected an integer
   --> /home/ccuu/Desktop/llm-detector/experiments/cache/crates_src/mio-uds/0.6.8/mio-uds-0.6.8/src/socket.rs:160:39
    |
160 |         let addr: libc::sockaddr_un = mem::uninitialized();
    |                                       ^^^^^^^^^^^^^^^^^^^^ Undefined Behavior occurred here
    |
    = help: this indicates a bug in the program: it performed an invalid operation, and caused Undefined Behavior
    = help: see https://doc.rust-lang.org/nightly/reference/behavior-considered-undefined.html for further information
    = note: BACKTRACE:
    = note: inside `mio_uds::socket::sun_path_offset` at /home/ccuu/Desktop/llm-detector/experiments/cache/crates_src/mio-uds/0.6.8/mio-uds-0.6.8/src/socket.rs:160:39: 160:59
    = note: inside `mio_uds::socket::sockaddr_un` at /home/ccuu/Desktop/llm-detector/experiments/cache/crates_src/mio-uds/0.6.8/mio-uds-0.6.8/src/socket.rs:149:19: 149:36
    = note: inside `mio_uds::UnixDatagram::_bind` at /home/ccuu/Desktop/llm-detector/experiments/cache/crates_src/mio-uds/0.6.8/mio-uds-0.6.8/src/datagram.rs:29:36: 29:53
    = note: inside `mio_uds::UnixDatagram::bind::<&std::path::PathBuf>` at /home/ccuu/Desktop/llm-detector/experiments/cache/crates_src/mio-uds/0.6.8/mio-uds-0.6.8/src/datagram.rs:24:9: 24:43
note: inside `main`
   --> src/main.rs:17:13
    |
 17 |     let _ = UnixDatagram::bind(&path);
    |             ^^^^^^^^^^^^^^^^^^^^^^^^^

note: some details are omitted, run with `MIRIFLAGS=-Zmiri-backtrace=full` for a verbose backtrace

error: aborting due to 1 previous error

We appreciate your work on this crate and hope this report helps improve its safety.