Potential Undefined Behavior when calling insert.

[lewismosciski]

Hi there!

We scanned the most popular libraries on crates.io and found some memory safety bugs in this library.

In out-of-memory scenarios, alloc silently returns a null pointer. The immediate dereference of this pointer causes Undefined Behavior.

PoC

use linked_hash_map::LinkedHashMap;
use std::alloc::{GlobalAlloc, Layout, System};
use std::sync::atomic::{AtomicBool, Ordering};

static FAIL_NEXT_NODE_ALLOC: AtomicBool = AtomicBool::new(false);

struct FailNodeAlloc;

unsafe impl GlobalAlloc for FailNodeAlloc {
    unsafe fn alloc(&self, layout: Layout) -> *mut u8 {
        // Heuristic: the guard node is a Node<K,V> with {next, prev, key, value}.
        // For K=usize, V=usize on 64-bit, this is typically 32 bytes.
        if layout.size() == 32 && layout.align() == 8 && FAIL_NEXT_NODE_ALLOC.swap(false, Ordering::SeqCst) {
            return std::ptr::null_mut(); // simulate allocation failure (OOM)
        }
        System.alloc(layout)
    }

    unsafe fn dealloc(&self, ptr: *mut u8, layout: Layout) {
        System.dealloc(ptr, layout)
    }
}

#[global_allocator]
static A: FailNodeAlloc = FailNodeAlloc;

fn main() {
    let mut m: LinkedHashMap<usize, usize> = LinkedHashMap::new();

    // Make the next guard-node allocation fail inside ensure_guard_node().
    FAIL_NEXT_NODE_ALLOC.store(true, Ordering::SeqCst);

    // This safe call should trigger ensure_guard_node() internally, which does:
    // self.head = alloc(...); then immediately deref (*self.head) without null-check.
    let _ = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| {
        m.insert(1, 1);
    }));
    std::mem::drop(m);
}

Miri Output

error: Undefined Behavior: memory access failed: attempting to access 8 bytes, but got null pointer
   --> /home/ccuu/Desktop/llm-detector/experiments/cache/crates_src/linked-hash-map/0.5.6/linked-hash-map-0.5.6/src/lib.rs:188:17
    |
188 |                 (*self.head).next = self.head;
    |                 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Undefined Behavior occurred here
    |
    = help: this indicates a bug in the program: it performed an invalid operation, and caused Undefined Behavior
    = help: see https://doc.rust-lang.org/nightly/reference/behavior-considered-undefined.html for further information
    = note: BACKTRACE:
    = note: inside `linked_hash_map::LinkedHashMap::<usize, usize>::ensure_guard_node` at /home/ccuu/Desktop/llm-detector/experiments/cache/crates_src/linked-hash-map/0.5.6/linked-hash-map-0.5.6/src/lib.rs:188:17: 188:46
    = note: inside `linked_hash_map::LinkedHashMap::<usize, usize>::insert` at /home/ccuu/Desktop/llm-detector/experiments/cache/crates_src/linked-hash-map/0.5.6/linked-hash-map-0.5.6/src/lib.rs:316:9: 316:33
note: inside closure
   --> src/main.rs:42:9
    |
 42 |         m.insert(1, 1);
    |         ^^^^^^^^^^^^^^
    = note: inside `<{closure@src/main.rs:41:67: 41:69} as std::ops::FnOnce<()>>::call_once - shim` at /home/ccuu/.rustup/toolchains/nightly-2025-10-09-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/ops/function.rs:250:5: 250:71
    = note: inside `<std::panic::AssertUnwindSafe<{closure@src/main.rs:41:67: 41:69}> as std::ops::FnOnce<()>>::call_once` at /home/ccuu/.rustup/toolchains/nightly-2025-10-09-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/panic/unwind_safe.rs:274:9: 274:19
    = note: inside `std::panicking::catch_unwind::do_call::<std::panic::AssertUnwindSafe<{closure@src/main.rs:41:67: 41:69}>, ()>` at /home/ccuu/.rustup/toolchains/nightly-2025-10-09-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/panicking.rs:590:40: 590:43
    = note: inside `std::panicking::catch_unwind::<(), std::panic::AssertUnwindSafe<{closure@src/main.rs:41:67: 41:69}>>` at /home/ccuu/.rustup/toolchains/nightly-2025-10-09-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/panicking.rs:553:19: 553:88
    = note: inside `std::panic::catch_unwind::<std::panic::AssertUnwindSafe<{closure@src/main.rs:41:67: 41:69}>, ()>` at /home/ccuu/.rustup/toolchains/nightly-2025-10-09-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/panic.rs:359:14: 359:40
note: inside `main`
   --> src/main.rs:41:13
    |
 41 |       let _ = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| {
    |  _____________^
 42 | |         m.insert(1, 1);
 43 | |     }));
    | |_______^

note: some details are omitted, run with `MIRIFLAGS=-Zmiri-backtrace=full` for a verbose backtrace

error: aborting due to 1 previous error

We appreciate your work on this crate and hope this report helps improve its safety.