diff --git a/crates/fltk/RUSTSEC-0000-0000.md b/crates/fltk/RUSTSEC-0000-0000.md new file mode 100644 index 0000000..8848f07 --- /dev/null +++ b/crates/fltk/RUSTSEC-0000-0000.md @@ -0,0 +1,18 @@ +```toml +[advisory] +id = "RUSTSEC-0000-0000" +package = "fltk" +date = "2021-03-06" +categories = ["memory-corruption"] +functions = { "fltk::prelude::WidgetExt::set_label_type" = ["< 0.15.2"], "fltk::prelude::WindowExt::set_icon" = ["< 0.14.12"], fltk::image::Pixmap::new = ["< 0.15.2, >= 0.14.12"] } +[versions] +patched = [">= 0.15.3"] +``` + +# Multiple memory safety issues + +Affected versions contain multiple memory safety issues, such as: + + - Setting a multi label type where an image doesn't exist would lead to a NULL pointer dereference. + - Setting a window icon using a non-raster image (which FLTK rasterizes lazily) would lead to a NULL dereference. + - Pixmap constructor would not check for correct pixmaps which could lead to out-of bound reads.