From a1076cfa18e31a016c396610e8cb7343c2595c55 Mon Sep 17 00:00:00 2001 From: Ammar Askar Date: Sat, 26 Sep 2020 00:49:15 -0700 Subject: [PATCH 1/5] Add advisory for out-of-bounds read in array-queue. --- crates/array-queue/RUSTSEC-0000-0000.toml | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) create mode 100644 crates/array-queue/RUSTSEC-0000-0000.toml diff --git a/crates/array-queue/RUSTSEC-0000-0000.toml b/crates/array-queue/RUSTSEC-0000-0000.toml new file mode 100644 index 0000000..6b00f78 --- /dev/null +++ b/crates/array-queue/RUSTSEC-0000-0000.toml @@ -0,0 +1,16 @@ +[advisory] +id = "RUSTSEC-0000-0000" +package = "array-queue" +date = "2020-09-26" +title = "array_queue pop_back allows an out-of-bounds read." +url = "https://github.com/raviqqe/array-queue/issues/2" +description = """ +array_queue implements a circular queue that wraps around an array. However, it +fails to properly index into the array in the `pop_back` function allowing the +reading of previously dropped or uninitialized memory. +""" +keywords = ["memory-corruption", "uninitialized-memory"] + + +[versions] +patched = [] From ee8f6684008994ce062f6acb53537946b045fa8c Mon Sep 17 00:00:00 2001 From: "Sergey \"Shnatsel\" Davidoff" Date: Sat, 26 Sep 2020 12:23:43 +0200 Subject: [PATCH 2/5] Update RUSTSEC-0000-0000.toml --- crates/array-queue/RUSTSEC-0000-0000.toml | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/crates/array-queue/RUSTSEC-0000-0000.toml b/crates/array-queue/RUSTSEC-0000-0000.toml index 6b00f78..8afe76b 100644 --- a/crates/array-queue/RUSTSEC-0000-0000.toml +++ b/crates/array-queue/RUSTSEC-0000-0000.toml @@ -2,15 +2,17 @@ id = "RUSTSEC-0000-0000" package = "array-queue" date = "2020-09-26" -title = "array_queue pop_back allows an out-of-bounds read." +title = "array_queue pop_back() may cause a use-after-free" url = "https://github.com/raviqqe/array-queue/issues/2" description = """ array_queue implements a circular queue that wraps around an array. However, it fails to properly index into the array in the `pop_back` function allowing the reading of previously dropped or uninitialized memory. """ -keywords = ["memory-corruption", "uninitialized-memory"] - +keywords = ["memory-corruption", "uninitialized-memory", "use-after-free"] +functions = { "array_queue::ArrayQueue::push_back" = [">= 0.3.0"] } [versions] + patched = [] +unaffected = ["< 0.3.0"] From d0bdfc95469e6a7b35433234ef6f5006d6fd2055 Mon Sep 17 00:00:00 2001 From: "Sergey \"Shnatsel\" Davidoff" Date: Sat, 26 Sep 2020 12:25:05 +0200 Subject: [PATCH 3/5] Update RUSTSEC-0000-0000.toml --- crates/array-queue/RUSTSEC-0000-0000.toml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/crates/array-queue/RUSTSEC-0000-0000.toml b/crates/array-queue/RUSTSEC-0000-0000.toml index 8afe76b..cc4ead3 100644 --- a/crates/array-queue/RUSTSEC-0000-0000.toml +++ b/crates/array-queue/RUSTSEC-0000-0000.toml @@ -10,6 +10,8 @@ fails to properly index into the array in the `pop_back` function allowing the reading of previously dropped or uninitialized memory. """ keywords = ["memory-corruption", "uninitialized-memory", "use-after-free"] + +[affected] functions = { "array_queue::ArrayQueue::push_back" = [">= 0.3.0"] } [versions] From bd394d56fda1b8cad64a6edcf7eb8fb3af2629ed Mon Sep 17 00:00:00 2001 From: "Sergey \"Shnatsel\" Davidoff" Date: Sat, 26 Sep 2020 12:26:17 +0200 Subject: [PATCH 4/5] Update RUSTSEC-0000-0000.toml --- crates/array-queue/RUSTSEC-0000-0000.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crates/array-queue/RUSTSEC-0000-0000.toml b/crates/array-queue/RUSTSEC-0000-0000.toml index cc4ead3..3998813 100644 --- a/crates/array-queue/RUSTSEC-0000-0000.toml +++ b/crates/array-queue/RUSTSEC-0000-0000.toml @@ -12,7 +12,7 @@ reading of previously dropped or uninitialized memory. keywords = ["memory-corruption", "uninitialized-memory", "use-after-free"] [affected] -functions = { "array_queue::ArrayQueue::push_back" = [">= 0.3.0"] } +functions = { "array-queue::ArrayQueue::push_back" = [">= 0.3.0"] } [versions] From ebd9ffcac8dac7ed1c22392e21f6ce6d73e8b0e7 Mon Sep 17 00:00:00 2001 From: "Sergey \"Shnatsel\" Davidoff" Date: Sat, 26 Sep 2020 12:27:30 +0200 Subject: [PATCH 5/5] Update RUSTSEC-0000-0000.toml --- crates/array-queue/RUSTSEC-0000-0000.toml | 3 --- 1 file changed, 3 deletions(-) diff --git a/crates/array-queue/RUSTSEC-0000-0000.toml b/crates/array-queue/RUSTSEC-0000-0000.toml index 3998813..acc255b 100644 --- a/crates/array-queue/RUSTSEC-0000-0000.toml +++ b/crates/array-queue/RUSTSEC-0000-0000.toml @@ -11,9 +11,6 @@ reading of previously dropped or uninitialized memory. """ keywords = ["memory-corruption", "uninitialized-memory", "use-after-free"] -[affected] -functions = { "array-queue::ArrayQueue::push_back" = [">= 0.3.0"] } - [versions] patched = []