From 6e74bc0d1845bdad8275c42e91c597a07d13d83a Mon Sep 17 00:00:00 2001 From: Kisaragi <48310258+KisaragiEffective@users.noreply.github.com> Date: Sat, 25 Feb 2023 23:30:18 +0900 Subject: [PATCH] Add ascii advisory (#1618) * Add ascii advisory * Strip unnecessary comments * Fix version range specification and category * Change fixed version specification to `>= 0.9.3` --------- Co-authored-by: Sergey "Shnatsel" Davidoff --- crates/ascii/RUSTSEC-0000-0000.md | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) create mode 100644 crates/ascii/RUSTSEC-0000-0000.md diff --git a/crates/ascii/RUSTSEC-0000-0000.md b/crates/ascii/RUSTSEC-0000-0000.md new file mode 100644 index 0000000..cfc7387 --- /dev/null +++ b/crates/ascii/RUSTSEC-0000-0000.md @@ -0,0 +1,19 @@ +```toml +[advisory] +id = "RUSTSEC-0000-0000" +package = "ascii" +date = "2023-02-25" +url = "https://github.com/tomprogrammer/rust-ascii/issues/64" +informational = "unsound" +categories = ["memory-corruption"] +keywords = ["ascii"] +[versions] +patched = [">= 0.9.3"] +unaffected = ["<= 0.6.0"] +``` + +# Ascii allows out-of-bounds array indexing in safe code + +Affected version of this crate had implementation of `From<&mut AsciiStr>` for `&mut [u8]` and `&mut str`. This can result in out-of-bounds array indexing in safe code. + +The flaw was corrected in commit [8a6c779](https://github.com/tomprogrammer/rust-ascii/pull/63/commits/8a6c7798c202766bd57d70fb8d12739dd68fb9dc) by removing those impls.