diff --git a/crates/fltk/RUSTSEC-0000-0000.md b/crates/fltk/RUSTSEC-0000-0000.md new file mode 100644 index 0000000..a330144 --- /dev/null +++ b/crates/fltk/RUSTSEC-0000-0000.md @@ -0,0 +1,24 @@ +```toml +[advisory] +id = "RUSTSEC-0000-0000" +package = "fltk" +date = "2021-03-06" +keywords = ["undefined_behavior"] +url = "https://github.com/MoAlyousef/fltk-rs/issues/519" + +[affected.functions] +"fltk::prelude::WidgetExt::set_label_type" = ["< 0.15.2"] +"fltk::prelude::WindowExt::set_icon" = ["< 0.14.12"] +"fltk::image::Pixmap::new" = ["< 0.15.2, >= 0.14.12"] + +[versions] +patched = [">= 0.15.3"] +``` + +# Multiple memory safety issues + +Affected versions contain multiple memory safety issues, such as: + + - Setting a multi label type where an image doesn't exist would lead to a NULL pointer dereference. + - Setting a window icon using a non-raster image (which FLTK rasterizes lazily) would lead to a NULL dereference. + - Pixmap constructor would not check for correct pixmaps which could lead to out-of bound reads.