{"id":13472491,"url":"https://github.com/sslab-gatech/Rudra","last_synced_at":"2025-03-26T17:30:33.619Z","repository":{"id":44940095,"uuid":"309803886","full_name":"sslab-gatech/Rudra","owner":"sslab-gatech","description":"Rust Memory Safety \u0026 Undefined Behavior Detection","archived":false,"fork":false,"pushed_at":"2024-03-09T22:16:18.000Z","size":1265,"stargazers_count":1329,"open_issues_count":7,"forks_count":46,"subscribers_count":28,"default_branch":"master","last_synced_at":"2025-03-25T09:03:56.612Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/sslab-gatech.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE-APACHE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":"CITATION.cff","codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2020-11-03T20:50:23.000Z","updated_at":"2025-03-22T22:49:32.000Z","dependencies_parsed_at":"2024-01-07T12:17:06.317Z","dependency_job_id":"7189a578-df3d-4d53-a7b5-102dd605e9eb","html_url":"https://github.com/sslab-gatech/Rudra","commit_stats":null,"previous_names":[],"tags_count":2,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sslab-gatech%2FRudra","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sslab-gatech%2FRudra/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sslab-gatech%2FRudra/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sslab-gatech%2FRudra/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/sslab-gatech","download_url":"https://codeload.github.com/sslab-gatech/Rudra/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":245702093,"owners_count":20658539,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-07-31T16:00:55.085Z","updated_at":"2025-03-26T17:30:33.228Z","avatar_url":"https://github.com/sslab-gatech.png","language":"Rust","funding_links":[],"categories":["Projects","Rust","Static Checkers","Programming Languages"],"sub_categories":["Verification"],"readme":"# Rudra\n\nRudra is a static analyzer to detect common undefined behaviors in Rust programs.\nIt is capable of analyzing single Rust packages as well as all the packages on\ncrates.io.\n\nRudra and its associated paper received the Distinguished Artifact Award at\n*the 28th ACM Symposium on Operating Systems Principles 2021*\n(SOSP '21). ([PDF](./rudra-sosp21.pdf), [short talk](https://youtu.be/7pI9GfYEu-s), [long talk](https://youtu.be/Hfl6EQquUU0))\n\nYou can find the list of bugs found by Rudra at [Rudra-PoC](https://github.com/sslab-gatech/Rudra-PoC) repository.\n\n## Usage\n\nThe easiest way to use Rudra is to use [Docker](https://www.docker.com/).\n\n1. First, make sure your system has Docker and Python 3 installed.\n2. Add `rudra:latest` image on your system. There are two ways of doing this:\n    * `docker pull ghcr.io/sslab-gatech/rudra:master \u0026\u0026 docker tag ghcr.io/sslab-gatech/rudra:master rudra:latest`\n    * Alternatively, you can build your own image with `docker build . -t rudra:latest`\n3. Run `./setup_rudra_runner_home.py \u003cdirectory\u003e` and set `RUDRA_RUNNER_HOME` to that directory.\n   Example: `./setup_rudra_runner_home.py ~/rudra-home \u0026\u0026 export RUDRA_RUNNER_HOME=$HOME/rudra-home`.\n    * There are two scripts, `./setup_rudra_runner_home.py` and `./setup_rudra_runner_home_fixed.py`.\n      In general, `./setup_rudra_runner_home.py` should be used unless you want to reproduce the result of the paper\n      with a fixed cargo index.\n4. Add `docker-helper` in Rudra repository to `$PATH`. Now you are ready to test Rudra!\n\nFor development, you might want to install Rudra on your host system.\nSee [DEV.md](DEV.md) for advanced usage and development guide.\n\n### Run Rudra on a single project\n\n```\ndocker-cargo-rudra \u003cdirectory\u003e\n```\n\nThe log and report are printed to stderr by default.\n\n### Run Rudra as GitHub Action\n\nRudra can be run as a GitHub Action allowing the static analyze to be used in an Action workflow.\n\n```yml\n# Run Rudra\n- name: Rudra\n  uses: sslab-gatech/Rudra@master\n```\n\n### Run Rudra with different compiler version\n\nRudra is tied to a specific Rust compiler version,\nand it can only analyze projects that compiles with this version of the compiler.\n`master` branch uses `nightly-2021-10-21` version of Rust right now.\nCheck [the version page][version] for all supported versions.\n\n[version]: https://github.com/sslab-gatech/Rudra/pkgs/container/rudra/versions?filters%5Bversion_type%5D=tagged\n\n### Known Issues\n\n- Rudra does not support workspaces (#11).\n  You can install Rudra on your host system (see [DEV.md](./DEV.md))\n  and run analysis in the subdirectories to sidestep the problem for now.\n- Rudra does not support suppressing warnings in specific locations.\n  This could cause a usability issue when used in CI/CD due to false positives.\n\n## Bug Types Detected by Rudra\n\nRudra currently detects the following bug types.\nFor the full detail, please check our SOSP 2021 paper.\n\n### Panic Safety (Unsafe code that can create memory-safety issues when panicked)\n\nDetects when unsafe code may lead to memory safety issues if a user provided\nclosure or trait panics. For example, consider a function that dereferences a\npointer with `ptr::read`, duplicating its ownership and then calls a user\nprovided function `f`. This can lead to a double-free if the function `f`\npanics.\n\nSee [this section of the Rustonomicon](https://doc.rust-lang.org/nomicon/exception-safety.html)\nfor more details.\n\n```rust\nwhile idx \u003c len {\n    let ch = unsafe { self.get_unchecked(idx..len).chars().next().unwrap() };\n    let ch_len = ch.len_utf8();\n\n    // Call to user provided predicate function f that can panic.\n    if !f(ch) {\n        del_bytes += ch_len;\n    } else if del_bytes \u003e 0 {\n        unsafe {\n            ptr::copy(\n                self.vec.as_ptr().add(idx),\n                self.vec.as_mut_ptr().add(idx - del_bytes),\n                ch_len,\n            );\n        }\n    }\n\n    // Point idx to the next char\n    idx += ch_len;\n}\n```\n\nExample: [rust#78498](https://github.com/rust-lang/rust/issues/78498)\n\n### Higher Order Invariant (Assumed properties about traits)\n\nWhen code assumes certain properties about trait methods that aren't enforced,\nsuch as expecting the `Borrow` trait to return the same reference on multiple\ncalls to `borrow`.\n\n```rust\nlet mut g = Guard { len: buf.len(), buf }; \n// ...\n  Ok(n) =\u003e g.len += n, \n```\n\nExample: [rust#80894](https://github.com/rust-lang/rust/issues/80894)\n\n### Send Sync Variance (Unrestricted Send or Sync on generic types)\n\nThis occurs when a type generic over `T` implements Send or Sync without having\ncorrect bounds on `T`.\n\n```rust\nunsafe impl\u003cT: ?Sized + Send, U: ?Sized\u003e Send for MappedMutexGuard\u003c'_, T, U\u003e {} \nunsafe impl\u003cT: ?Sized + Sync, U: ?Sized\u003e Sync for MappedMutexGuard\u003c'_, T, U\u003e {} \n```\n\nExample: [futures#2239](https://github.com/rust-lang/futures-rs/issues/2239)\n\n## Bugs Found by Rudra\n\nRudra was ran on the entirety of crates.io state as of July 4th, 2020 as well\nas the Rust standard library from `nightly-2020-08-26`. It managed to find 264\nnew memory safety issues across the Rust ecosystem which resulted in 76 CVEs.\n\nThe details of these bugs can be found in the [Rudra-PoC repo](https://github.com/sslab-gatech/Rudra-PoC).\n\n## License\n\nLicensed under either of\n\n * Apache License, Version 2.0, ([LICENSE-APACHE](LICENSE-APACHE) or http://www.apache.org/licenses/LICENSE-2.0)\n * MIT license ([LICENSE-MIT](LICENSE-MIT) or http://opensource.org/licenses/MIT)\n\nat your option.\n\n### Contribution\n\nUnless you explicitly state otherwise, any contribution intentionally submitted\nfor inclusion in the work by you, as defined in the Apache-2.0 license, shall be dual licensed as above, without any\nadditional terms or conditions.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsslab-gatech%2FRudra","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsslab-gatech%2FRudra","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsslab-gatech%2FRudra/lists"}