TYPEPULSE: Detecting Type Confusion Bugs in Rust Programs

• URL: http://arxiv.org/abs/2502.03271v1
• Date: Wed, 05 Feb 2025 15:27:08 GMT
• Title: TYPEPULSE: Detecting Type Confusion Bugs in Rust Programs
• Abstract summary: Rust supports type conversions and safe Rust guarantees the security of these conversions.<n>These conversions may cause severe memory corruption problems.<n>Despite extensive research on type confusion bugs in C/C++, studies on type confusion bugs in Rust are still lacking.
• Score: 17.491119986027925
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Rust supports type conversions and safe Rust guarantees the security of these conversions through robust static type checking and strict ownership guidelines. However, there are instances where programmers need to use unsafe Rust for certain type conversions, especially those involving pointers. Consequently, these conversions may cause severe memory corruption problems. Despite extensive research on type confusion bugs in C/C++, studies on type confusion bugs in Rust are still lacking. Also, due to Rust's new features in the type system, existing solutions in C/C++ cannot be directly applied to Rust. In this paper, we develop a static analysis tool called TYPEPULSE to detect three main categories of type confusion bugs in Rust including misalignment, inconsistent layout, and mismatched scope. TYPEPULSE first performs a type conversion analysis to collect and determine trait bounds for type pairs. Moreover, it performs a pointer alias analysis to resolve the alias relationship of pointers. Following the integration of information into the property graph, it constructs type patterns and detects each type of bug in various conversion scenarios. We run TYPEPULSE on the top 3,000 Rust packages and uncover 71 new type confusion bugs, exceeding the total number of type confusion bugs reported in RUSTSEC over the past five years. We have received 32 confirmations from developers, along with one CVE ID and six RUSTSEC IDs.

Related papers

• Rust's Type Checker Implementation Is Unsound: An Empirical Study on Soundness Bugs in rustc [5.513280759193012]
  Rust is claimed to be a type-sound language capable of preventing undesirable behaviors, including memory bugs.<n>Rustc is not immune to defects; it contains soundness bugs, where the compiler accepts programs that should be rejected.<n>We present an empirical study of 30 issues that report potential soundness bugs in rustc, collected from the GitHub issue tracker.
  arXiv  Detail & Related papers  (2026-08-28T07:59:19Z)
• From C to Idiomatic Rust: A Ship-of-Theseus Agentic Translation [0.13537117504260618]
  C underpins operating systems, embedded platforms, and network infrastructure because its abstractions map directly to machine behaviour.<n> Rust eliminates most of failure modes through a static ownership and borrowing model that enforces memory safety and aliasing constraints at compile time.<n>This paper presents a migration methodology that first generates a semantics-preserving, non-idiomatic Rust baseline and then incrementally rewrites it into idiomatic Rust using agentic AI.
  arXiv  Detail & Related papers  (2026-07-30T21:00:27Z)
• Generative Compilation: On-the-Fly Compiler Feedback as AI Generates Code [43.07697210931911]
  We introduce generative compilation, the first approach to obtaining compiler feedback on partial programs during generation.<n>We show that generative compilation reduces non-compiling outputs and improves functional correctness, relative to standard post-generation feedback.
  arXiv  Detail & Related papers  (2026-07-15T15:00:22Z)
• Forcrat: Automatic I/O API Translation from C to Rust via Origin and Capability Analysis [10.16257074782054]
  We focus on replacing the I/O API, an important subset of library functions.<n>We propose two static analysis techniques, origin and capability analysis and error source analysis, and use their results to replace the I/O API.<n>Our evaluation shows that the proposed approach is (1) correct, with all 32 programs that have test suites passing the tests after transformation, (2) efficient, analyzing and transforming 422k LOC in 14 seconds, and (3) widely applicable, replacing 82% of I/O API calls.
  arXiv  Detail & Related papers  (2025-06-02T08:34:06Z)
• CRUST-Bench: A Comprehensive Benchmark for C-to-safe-Rust Transpilation [63.23120252801889]
  CRUST-Bench is a dataset of 100 C repositories, each paired with manually-written interfaces in safe Rust as well as test cases. We evaluate state-of-the-art large language models (LLMs) on this task and find that safe and idiomatic Rust generation is still a challenging problem. The best performing model, OpenAI o1, is able to solve only 15 tasks in a single-shot setting.
  arXiv  Detail & Related papers  (2025-04-21T17:33:33Z)
• RustMap: Towards Project-Scale C-to-Rust Migration via Program Analysis and LLM [13.584956125542396]
  Rust offers superior memory safety while maintaining C's high performance. Existing automated translation tools, such as C2Rust, may rely too much on syntactic, template-based translation. This paper introduces a novel dependency-guided and large language model (LLM)-based C-to-Rust translation approach, RustMap.
  arXiv  Detail & Related papers  (2025-03-22T11:57:45Z)
• Beyond the Edge of Function: Unraveling the Patterns of Type Recovery in Binary Code [55.493408628371235]
  We propose ByteTR, a framework for recovering variable types in binary code. In light of the ubiquity of variable propagation across functions, ByteTR conducts inter-procedural analysis to trace variable propagation and employs a gated graph neural network to capture long-range data flow dependencies for variable type recovery.
  arXiv  Detail & Related papers  (2025-03-10T12:27:05Z)
• ReF Decompile: Relabeling and Function Call Enhanced Decompile [50.86228893636785]
  The goal of decompilation is to convert compiled low-level code (e.g., assembly code) back into high-level programming languages. This task supports various reverse engineering applications, such as vulnerability identification, malware analysis, and legacy software migration.
  arXiv  Detail & Related papers  (2025-02-17T12:38:57Z)
• C2SaferRust: Transforming C Projects into Safer Rust with NeuroSymbolic Techniques [16.111888466557144]
  We present C2SaferRust, a novel approach to translate C to Rust.<n>We first use C2Rust to convert C code to non-idiomatic, unsafe Rust.<n>We decompose the unsafe Rust code into slices that can be individually translated to safer Rust by an LLM.<n>After processing each slice, we run end-to-end test cases to verify that the code still functions as expected.
  arXiv  Detail & Related papers  (2025-01-24T05:53:07Z)
• SVTRv2: CTC Beats Encoder-Decoder Models in Scene Text Recognition [77.28814034644287]
  We propose SVTRv2, a CTC model that beats leading EDTRs in both accuracy and inference speed. SVTRv2 introduces novel upgrades to handle text irregularity and utilize linguistic context. We evaluate SVTRv2 in both standard and recent challenging benchmarks.
  arXiv  Detail & Related papers  (2024-11-24T14:21:35Z)
• A Study of Undefined Behavior Across Foreign Function Boundaries in Rust Libraries [2.359557447960552]
  Rust is frequently used to interoperate with other languages.<n>Miri is the only dynamic analysis tool that can validate applications against these models.<n>Miri does not support foreign functions, indicating that there may be a critical correctness gap across the Rust ecosystem.
  arXiv  Detail & Related papers  (2024-04-17T18:12:05Z)
• FoC: Figure out the Cryptographic Functions in Stripped Binaries with LLMs [54.27040631527217]
  We propose a novel framework called FoC to Figure out the Cryptographic functions in stripped binaries. We first build a binary large language model (FoC-BinLLM) to summarize the semantics of cryptographic functions in natural language. We then build a binary code similarity model (FoC-Sim) upon the FoC-BinLLM to create change-sensitive representations and use it to retrieve similar implementations of unknown cryptographic functions in a database.
  arXiv  Detail & Related papers  (2024-03-27T09:45:33Z)
• Fixing Rust Compilation Errors using LLMs [2.1781086368581932]
  The Rust programming language has established itself as a viable choice for low-level systems programming language over the traditional, unsafe alternatives like C/C++. This paper presents a tool called RustAssistant that leverages the emergent capabilities of Large Language Models (LLMs) to automatically suggest fixes for Rust compilation errors. RustAssistant is able to achieve an impressive peak accuracy of roughly 74% on real-world compilation errors in popular open-source Rust repositories.
  arXiv  Detail & Related papers  (2023-08-09T18:30:27Z)
• Generative Type Inference for Python [62.01560866916557]
  This paper introduces TypeGen, a few-shot generative type inference approach that incorporates static domain knowledge from static analysis. TypeGen creates chain-of-thought (COT) prompts by translating the type inference steps of static analysis into prompts based on the type dependency graphs (TDGs) Experiments show that TypeGen outperforms the best baseline Type4Py by 10.0% for argument type prediction and 22.5% in return value type prediction in terms of top-1 Exact Match.
  arXiv  Detail & Related papers  (2023-07-18T11:40:31Z)
• TypeT5: Seq2seq Type Inference using Static Analysis [51.153089609654174]
  We present a new type inference method that treats type prediction as a code infilling task. Our method uses static analysis to construct dynamic contexts for each code element whose type signature is to be predicted by the model. We also propose an iterative decoding scheme that incorporates previous type predictions in the model's input context.
  arXiv  Detail & Related papers  (2023-03-16T23:48:00Z)
• VarCLR: Variable Semantic Representation Pre-training via Contrastive Learning [84.70916463298109]
  VarCLR is a new approach for learning semantic representations of variable names. VarCLR is an excellent fit for contrastive learning, which aims to minimize the distance between explicitly similar inputs. We show that VarCLR enables the effective application of sophisticated, general-purpose language models like BERT.
  arXiv  Detail & Related papers  (2021-12-05T18:40:32Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.