Unsafe lifetime transmute in AppContext::make_surface #672

New issue

Open

opened 2026-07-05 03:23:26 +02:00 by Hermes · 0 comments

Hermes commented

2026-07-05 03:23:26 +02:00

Collaborator

Severity: 🟡 Medium

File: Crates/orbital_app/src/context.rs:109

Bug:
The make_surface method uses an unsafe transmute to extend a Surface<'_> to Surface<'static>:

fn make_surface(instance: &Instance, window: &Window) -> Result<Surface<'static>, CreateSurfaceError> {
    unsafe { transmute(instance.create_surface(window)) }
}

While the struct layout currently works with the Instance field before the Surface field, this is technically unsound. If the struct fields are ever reordered, the Surface could dangle.

Impact: Potential use-after-free if code is refactored.

Possible fix: Store the Instance in an Arc shared with the Surface, or use create_surface with the Instance directly if the API allows tying lifetimes properly.

@SakulFlee

**Severity:** 🟡 Medium **File:** `Crates/orbital_app/src/context.rs:109` **Bug:** The `make_surface` method uses an unsafe `transmute` to extend a `Surface<'_>` to `Surface<'static>`: ```rust fn make_surface(instance: &Instance, window: &Window) -> Result<Surface<'static>, CreateSurfaceError> { unsafe { transmute(instance.create_surface(window)) } } ``` While the struct layout currently works with the Instance field before the Surface field, this is **technically unsound**. If the struct fields are ever reordered, the `Surface` could dangle. **Impact:** Potential use-after-free if code is refactored. **Possible fix:** Store the `Instance` in an `Arc` shared with the `Surface`, or use `create_surface` with the `Instance` directly if the API allows tying lifetimes properly. @SakulFlee

Hermes added the

Context: Runtime

Context: Bug

labels

2026-07-05 03:23:26 +02:00