CodeVetter · Repo Unpack · Risk map
tokio-rs/tokio
These are source-observed contracts and explicitly identified hypotheses, not confirmed vulnerabilities. The most sensitive boundaries involve unsafe buffer access, reactor pointer lifetimes, scheduler shutdown, and externally visible filesystem/process effects. Cancellation and completion differ substantially between async tasks, blocking work, children, and buffered files. Changes to these areas require precise ownership and lifecycle reasoning beyond compilation.
- Reactor event tokens become ScheduledIo pointers through unsafe dereferencing; safety requires deregistration and exclusion of concurrent polling before those allocations can be freed.
- PollEvented casts uninitialized ReadBuf storage to a byte slice and assumes the returned bytes were initialized; TcpStream::poll_read_priv explicitly relies on the socket read contract.
- Started spawn_blocking tasks cannot be aborted, and shutdown can wait indefinitely; shutdown_timeout stops waiting without cancelling the underlying work.
- fs::write forwards caller paths to create/truncate or standard filesystem operations without a repository-root policy; File write acknowledgement, flush completion, and sync_all are distinct boundaries.
- Child drop leaves processes running by default, Unix reaping is best effort, and wait_with_output accumulates each output stream in a Vec without a limit in that implementation.
- On Unix, registering a signal replaces its default handler for the process lifetime; dropping the listener does not restore default SIGINT termination behavior.
- Allocation hypothesis: LengthDelimitedCodec checks the wire length before applying length_adjustment, then reserves the adjusted size; configuration therefore needs review when reasoning about memory bounds. (inferred)
- Scheduler shutdown depends on closing both OwnedTasks and the injection queue; documented races otherwise permit stranded task references, and a Loom test exercises core handoff during shutdown.