From 89842247a4c0a4cca61efc7197bad16deab5ffd0 Mon Sep 17 00:00:00 2001 From: Ammar Askar Date: Sat, 21 Aug 2021 21:44:58 -0400 Subject: [PATCH] Add advisory for out-of-bounds read in rdiff (#862) * Add advisory for out-of-bounds read in rdiff * Update crates/rdiff/RUSTSEC-0000-0000.md Co-authored-by: Tony Arcieri --- crates/rdiff/RUSTSEC-0000-0000.md | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) create mode 100644 crates/rdiff/RUSTSEC-0000-0000.md diff --git a/crates/rdiff/RUSTSEC-0000-0000.md b/crates/rdiff/RUSTSEC-0000-0000.md new file mode 100644 index 0000000..5956d44 --- /dev/null +++ b/crates/rdiff/RUSTSEC-0000-0000.md @@ -0,0 +1,23 @@ +```toml +[advisory] +id = "RUSTSEC-0000-0000" +package = "rdiff" +date = "2021-02-03" +url = "https://github.com/dyule/rdiff/issues/3" +categories = ["memory-exposure"] +informational = "unsound" + +[versions] +patched = [] +``` + +# Window can read out of bounds if Read instance returns more bytes than buffer size + +`rdiff` performs a diff of two provided strings or files. As part of its reading +code it uses the return value of a `Read` instance to set the length of +its internal character vector. + +If the `Read` implementation claims that it has read more bytes than the length +of the provided buffer, the length of the vector will be set to longer than its +capacity. This causes `rdiff` APIs to return uninitialized memory in its API +methods.