From d9614925ced7c2bf4df6bdb69d94cf50e8877f77 Mon Sep 17 00:00:00 2001 From: Ammar Askar Date: Tue, 2 Mar 2021 10:04:50 -0800 Subject: [PATCH] Add advisory for uninitialized memory drop in byte_struct --- crates/byte_struct/RUSTSEC-0000-0000.md | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) create mode 100644 crates/byte_struct/RUSTSEC-0000-0000.md diff --git a/crates/byte_struct/RUSTSEC-0000-0000.md b/crates/byte_struct/RUSTSEC-0000-0000.md new file mode 100644 index 0000000..d44ddb1 --- /dev/null +++ b/crates/byte_struct/RUSTSEC-0000-0000.md @@ -0,0 +1,24 @@ +```toml +[advisory] +id = "RUSTSEC-0000-0000" +package = "byte_struct" +date = "2021-03-01" +url = "https://github.com/wwylele/byte-struct-rs/issues/1" +categories = ["memory-corruption"] +keywords = ["memory-safety"] + +[versions] +patched = [">= 0.6.1"] +``` + +# Deserializing an array can drop uninitialized memory on panic + +The `read_bytes_default_le` function for `[T; n]` arrays, used to deserialize +arrays of `T` from bytes created a `[T; n]` array with `std::mem::uninitialized` +and then called `T`'s deserialization method. + +If `T`'s deserialization method panicked, the uninitialized memory could drop +invalid objects. + +This flaw was corrected in `a535678` by removing the unsafe block and using +a `.map` function to deserialize each element of the array instead.