From a33c05d20a71ee5e94c9bcba3a39c7e6e31292e6 Mon Sep 17 00:00:00 2001 From: MoAlyousef Date: Sat, 6 Mar 2021 22:01:14 +0300 Subject: [PATCH] add fltk advisory --- crates/fltk/RUSTSEC-0000-0000.md | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) create mode 100644 crates/fltk/RUSTSEC-0000-0000.md diff --git a/crates/fltk/RUSTSEC-0000-0000.md b/crates/fltk/RUSTSEC-0000-0000.md new file mode 100644 index 0000000..8848f07 --- /dev/null +++ b/crates/fltk/RUSTSEC-0000-0000.md @@ -0,0 +1,18 @@ +```toml +[advisory] +id = "RUSTSEC-0000-0000" +package = "fltk" +date = "2021-03-06" +categories = ["memory-corruption"] +functions = { "fltk::prelude::WidgetExt::set_label_type" = ["< 0.15.2"], "fltk::prelude::WindowExt::set_icon" = ["< 0.14.12"], fltk::image::Pixmap::new = ["< 0.15.2, >= 0.14.12"] } +[versions] +patched = [">= 0.15.3"] +``` + +# Multiple memory safety issues + +Affected versions contain multiple memory safety issues, such as: + + - Setting a multi label type where an image doesn't exist would lead to a NULL pointer dereference. + - Setting a window icon using a non-raster image (which FLTK rasterizes lazily) would lead to a NULL dereference. + - Pixmap constructor would not check for correct pixmaps which could lead to out-of bound reads.