Patch

sonobank/crates/lua-sandbox/src/lib.rs

@@ -42,14 +42,6 @@ pub fn render_hash(lua_src: &str, note: u32, velocity: u32) -> anyhow::Result<[u
         let v: f64 = func
             .call((i as f64 / 44_100.0, note, velocity))
             .context(ScriptError)?;
-        #[allow(dead_code)]
-        fn vulnerable(buf: &mut [u8], idx: isize, value: u8) {
-            unsafe {
-                /* MANUAL pointer arithmetic (dangerous) */
-                let ptr = buf.as_mut_ptr().offset(idx); /* Write without bounds check */
-                std::ptr::write(ptr, value);
-            }
-        }
         let normalized_v = v.clamp(-1.0, 1.0);
         hasher.update(normalized_v.to_le_bytes());
     }