Hi, I’m not a native English speaker, so I used AI to help translate this report. Some parts may not accurately express what I found, so please let me know if anything is unclear.
Main Problems
1. PID file race condition in --pin / --unpin
Location: src/pin.rs:53-64
The PID file is written by the child process after fork(), while the parent process returns before the PID file has necessarily been created.
This creates a race window where a subsequent --unpin invocation may run before the PID file exists and incorrectly report nothing pinned.
Multiple --pin invocations may also pass the owner check before either process has written the PID file.
2. Invalid TOML causes the entire configuration to fall back to defaults
Location: src/config.rs:209-214
If the TOML configuration fails to parse, the entire configuration is discarded and replaced with the default configuration.
This means that a single parsing error can cause otherwise valid user configuration to be ignored.
Details
1. PID file race condition
The relevant sequence appears to be:
--pin
|
v
live_owner()
|
v
fork()
|
+-- parent -> returns
|
+-- child -> writes PID file
Because the parent returns before the child writes the PID file, another --unpin can execute during this window.
In that case, live_owner() may not find the PID file and therefore behave as if no animator is running.
There is also a check-then-act race between multiple --pin invocations: two processes may both observe that there is no current owner before either one creates the PID file.
2. Invalid TOML configuration
Config::load() falls back to Config::default() when TOML parsing fails.
Therefore, an invalid TOML file does not merely reject the invalid value; it causes the complete user configuration to be replaced by the default configuration.
I have not included any exploit or proof-of-concept. These observations are based on the current source code.
Hi, I’m not a native English speaker, so I used AI to help translate this report. Some parts may not accurately express what I found, so please let me know if anything is unclear.
Main Problems
1. PID file race condition in
--pin/--unpinLocation:
src/pin.rs:53-64The PID file is written by the child process after
fork(), while the parent process returns before the PID file has necessarily been created.This creates a race window where a subsequent
--unpininvocation may run before the PID file exists and incorrectly reportnothing pinned.Multiple
--pininvocations may also pass the owner check before either process has written the PID file.2. Invalid TOML causes the entire configuration to fall back to defaults
Location:
src/config.rs:209-214If the TOML configuration fails to parse, the entire configuration is discarded and replaced with the default configuration.
This means that a single parsing error can cause otherwise valid user configuration to be ignored.
Details
1. PID file race condition
The relevant sequence appears to be:
Because the parent returns before the child writes the PID file, another
--unpincan execute during this window.In that case,
live_owner()may not find the PID file and therefore behave as if no animator is running.There is also a check-then-act race between multiple
--pininvocations: two processes may both observe that there is no current owner before either one creates the PID file.2. Invalid TOML configuration
Config::load()falls back toConfig::default()when TOML parsing fails.Therefore, an invalid TOML file does not merely reject the invalid value; it causes the complete user configuration to be replaced by the default configuration.
I have not included any exploit or proof-of-concept. These observations are based on the current source code.