Add atty potential unsoundness (unaligned read) advisory (#1462)

Co-authored-by: pinkforest <36498018+pinkforest@users.noreply.github.com>
This commit is contained in:
niluxv
2022-11-22 08:42:13 +00:00
committed by GitHub
parent 92a6db9442
commit 610c537916

View File

@@ -0,0 +1,37 @@
```toml
[advisory]
id = "RUSTSEC-0000-0000"
package = "atty"
date = "2021-07-04"
url = "https://github.com/softprops/atty/issues/50"
references = ["https://github.com/softprops/atty/pull/51", "https://github.com/softprops/atty/issues/57"]
keywords = ["unaligned-read"]
informational = "unsound"
[affected]
os = ["windows"]
[versions]
patched = []
```
# Potential unaligned read
On windows, `atty` dereferences a potentially unaligned pointer.
In practice however, the pointer won't be unaligned unless a custom global allocator is used.
In particular, the `System` allocator on windows uses `HeapAlloc`, which guarantees a large enough alignment.
# atty is Unmaintained
A Pull Request with a fix has been provided over a year ago but the maintainer seems to be unreachable.
Last release of `atty` was almost 3 years ago.
## Possible Alternative(s)
The below list has not been vetted in any way and may or may not contain alternatives;
- [is-terminal](https://crates.io/crates/is-terminal)
- std::io::IsTerminal *nightly-only experimental*