Use After Free in Actix with Cockroachdb

Use After Free (UAF) occurs when memory is deallocated but references to it remain in use, leading to undefined behavior or data corruption. In an Actix-based Rust service that communicates with CockroachDB, this risk can surface through unsafe handling of connection pools, statement objects, or row buffers across asynchronous boundaries.

Actix actors are long-lived and process messages asynchronously. If an actor holds a reference to a CockroachDB connection or a prepared statement beyond its intended lifetime—such as when reusing a connection pool entry after it has been dropped or when cloning a statement handle without ensuring the underlying prepared statement is still valid—UAF can occur. This is especially likely when integrating low-level database drivers that expose raw pointers or require explicit lifetime management.

CockroachDB’s PostgreSQL wire protocol compatibility means typical Rust PostgreSQL clients (e.g., tokio-postgres) are used. These clients rely on safe abstractions, but developers may inadvertently introduce UAF by:

• Storing a reference to a Client or Statement inside an actor that outlives the connection or prepared statement.
• Using Arc<Mutex<...>> to share connections without ensuring the underlying resources remain valid for the entire access period.
• Dropping a pool entry while an in-flight query is still using a borrowed handle to a CockroachDB session or transaction object.

An example scenario: an Actix actor receives a message to execute a query using a cloned handle to a Client. If the actor is stopped or the pool recycles the connection before the query future completes, the future may resolve on freed memory. This can corrupt data or cause crashes, potentially exposing sensitive data or enabling code execution when combined with other weaknesses.

Because middleBrick scans unauthenticated attack surfaces, it may detect patterns consistent with unsafe resource handling when analyzing API endpoints that interface with CockroachDB through Actix. The scanner does not infer internal state, but repeated unsafe patterns in endpoint logic can correlate with insecure coding practices that elevate risk.

To prevent Use After Free in Actix services using CockroachDB, ensure that all database resources live at least as long as their consumers and that ownership semantics are explicit. The following practices and code examples reduce UAF risk.

1. Use owned data and avoid holding references across await points

Do not store references to Client or Statement inside actors. Instead, clone lightweight handles and keep data owned.

use actix::prelude::*;
use tokio_postgres::{Client, NoTls};
use std::sync::Arc;

// Safe: wrap client in Arc and clone into the actor
struct DbActor {
    client: Arc,
}

impl Actor for DbActor {
    type Context = Context;
}

struct QueryData {
    sql: String,
}

struct QueryResult {
    rows: Vec<(i64, String)>,
}

impl Message for QueryData {
    type Result = Result;
}

impl Handler<QueryData> for DbActor {
    type Result = ResponseFuture<QueryResult>;

    fn handle(&mut self, msg: QueryData, _: &mut Self::Context) -> Self::Result {
        let client = Arc::clone(&self.client);
        let sql = msg.sql.clone(); // clone owned data, not a reference
        Box::pin(async move {
            let rows = client.query(&sql, &[]).await?;
            // process rows into owned types
            let result = QueryResult {
                rows: rows.iter().map(|row| (row.get(0), row.get(1))).collect(),
            };
            Ok(result)
        })
    }
}

2. Ensure prepared statements are valid for the actor’s lifetime

Prepare statements at startup and store them as owned Statement objects inside the actor. Do not clone statement handles across threads without ensuring the underlying connection is alive.

use actix::prelude::*;
use tokio_postgres::{Client, Statement, NoTls};
use std::sync::Arc;

struct PreparedActor {
    client: Arc,
    stmt: Arc<Statement>, // owned, prepared statement
}

impl Actor for PreparedActor {
    type Context = Context<Self>;
}

struct ExecuteWithParams {
    params: Vec<String>,
}

impl Message for ExecuteWithParams {
    type Result = Result<Vec<String>, tokio_postgres::Error>;
}

impl Handler<ExecuteWithParams> for PreparedActor {
    type Result = ResponseFuture<Vec<String>>;

    fn handle(&mut self, msg: ExecuteWithParams, _: &mut Self::Context) -> Self::Result {
        let stmt = Arc::clone(&self.stmt);
        let client = Arc::clone(&self.client);
        Box::pin(async move {
            let rows = client.query(&stmt, &msg.params).await?;
            let values: Vec<String> = rows.iter().map(|row| row.get(0)).collect();
            Ok(values)
        })
    }
}

/// Initialize actor with prepared statement
async fn start_prepared_actor(client: Arc<Client>) -> Addr<PreparedActor> {
    let stmt = client.prepare("SELECT data FROM table WHERE id = $1").await.unwrap();
    PreparedActor {
        client,
        stmt: Arc::new(stmt),
    }.start()
}

3. Use proper pooling and avoid returning references to pooled resources

Do not return references to rows or connections that may be reused or dropped. Always map rows to owned types before sending them between actors.

use actix::prelude::*;
use tokio_postgres::Client;
use std::sync::Arc;

struct SafeQueryActor {
    client: Arc<Client>,
}

impl Handler<QueryData> for SafeQueryActor {
    type Result = ResponseFuture<Result<Vec<i64>, tokio_postgres::Error>>;

    fn handle(&mut self, msg: QueryData, _: &mut Context<Self>) -> Self::Result {
        let client = Arc::clone(&self.client);
        let sql = msg.sql.clone();
        Box::pin(async move {
            let rows = client.query(&sql, &[]).await?;
            // Convert each row into an owned value immediately
            let ids: Vec<i64> = rows.iter().map(|row| row.get("id")).collect();
            Ok(ids)
        })
    }
}

By ensuring that all data extracted from CockroachDB is owned and not tied to borrowed references, you eliminate the conditions under which Use After Free can occur in an Actix service.