From 91edd1b4e55c6170fcd03df11978c500a9de3247 Mon Sep 17 00:00:00 2001 From: JOE1994 Date: Sat, 30 Jan 2021 19:40:14 -0500 Subject: [PATCH] Report 0112-ms3d to RustSec --- crates/ms3d/RUSTSEC-0000-0000.md | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) create mode 100644 crates/ms3d/RUSTSEC-0000-0000.md diff --git a/crates/ms3d/RUSTSEC-0000-0000.md b/crates/ms3d/RUSTSEC-0000-0000.md new file mode 100644 index 0000000..967ccad --- /dev/null +++ b/crates/ms3d/RUSTSEC-0000-0000.md @@ -0,0 +1,20 @@ +```toml +[advisory] +id = "RUSTSEC-0000-0000" +package = "ms3d" +date = "2021-01-26" +url = "https://github.com/andrewhickman/ms3d/issues/1" +categories = ["memory-exposure"] + +[versions] +patched = [">= 0.1.3"] +``` + +# `IoReader::read()`: user-provided `Read` on uninitialized buffer may cause UB + +Affected versions of this crate passes an uninitialized buffer to a user-provided `Read` implementation. + +Arbitrary `Read` implementations can read from the uninitialized buffer (memory exposure) and also can return incorrect number of bytes written to the buffer. +Reading from uninitialized memory produces undefined values that can quickly invoke undefined behavior. + +The flaw was fixed in commit 599313b by zero-initializing the buffer (via `self.buf.resize(len, 0)`) before passing it to `Read`. \ No newline at end of file