From 1613b211a40397ccb7d7153568027836701d2066 Mon Sep 17 00:00:00 2001 From: Yechan Bae Date: Mon, 18 Jan 2021 16:07:03 -0500 Subject: [PATCH] Report 0063-xcb to RustSec --- crates/xcb/RUSTSEC-0000-0000.md | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) create mode 100644 crates/xcb/RUSTSEC-0000-0000.md diff --git a/crates/xcb/RUSTSEC-0000-0000.md b/crates/xcb/RUSTSEC-0000-0000.md new file mode 100644 index 0000000..a894a44 --- /dev/null +++ b/crates/xcb/RUSTSEC-0000-0000.md @@ -0,0 +1,20 @@ +```toml +[advisory] +id = "RUSTSEC-0000-0000" +package = "xcb" +date = "2020-12-10" +url = "https://github.com/rtbo/rust-xcb/issues/93" +categories = ["memory-corruption"] +informational = "unsound" + +[versions] +patched = [] +``` + +# Soundness issue with base::Error + +`base::Error` type contains public field named `ptr`. +With this definition, it is possible to create a `base::Error` with an invalid pointer and trigger memory safety errors +such as use-after-free or double-free with safe Rust. + +The users of `xcb` crate are advised not to manipulate the field. \ No newline at end of file