From 64a69616a4a0f70a368db83baf379e1db1b61b81 Mon Sep 17 00:00:00 2001 From: Eyal Kalderon Date: Mon, 2 Sep 2019 14:05:48 +0800 Subject: [PATCH 1/2] Add advisory for renderdoc < 0.5.0 --- crates/renderdoc/RUSTSEC-0000-0000.toml | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) create mode 100644 crates/renderdoc/RUSTSEC-0000-0000.toml diff --git a/crates/renderdoc/RUSTSEC-0000-0000.toml b/crates/renderdoc/RUSTSEC-0000-0000.toml new file mode 100644 index 0000000..563c548 --- /dev/null +++ b/crates/renderdoc/RUSTSEC-0000-0000.toml @@ -0,0 +1,23 @@ +[advisory] +id = "RUSTSEC-0000-0000" +package = "renderdoc" +date = "2019-09-02" +title = "Internally mutating methods take immutable ref self" +description = """ +Affected versions of this crate exposed several methods which took `self` by +immutable reference, despite the requesting the RenderDoc API to set a mutable +value internally. + +This is technically unsound and calling these methods from multiple threads +without synchronization could lead to unexpected and unpredictable behavior. + +The flaw was corrected in release 0.5.0. +""" +patched_versions = [">= 0.5.0"] +url = "https://github.com/ebkalderon/renderdoc-rs/pull/32" +keywords = ["undefined_behavior"] +affected_os = ["linux", "windows"] +affected_functions = [ + "renderdoc::api::RenderDocV110::trigger_multi_frame_capture", + "renderdoc::api::RenderDocV120::set_capture_file_comments", +] From a17b8a3693d2942fbcf73db71132986b6f355022 Mon Sep 17 00:00:00 2001 From: Eyal Kalderon Date: Tue, 3 Sep 2019 10:30:29 +0800 Subject: [PATCH 2/2] Remove unnecessary affected_os key --- crates/renderdoc/RUSTSEC-0000-0000.toml | 1 - 1 file changed, 1 deletion(-) diff --git a/crates/renderdoc/RUSTSEC-0000-0000.toml b/crates/renderdoc/RUSTSEC-0000-0000.toml index 563c548..dd1e7ea 100644 --- a/crates/renderdoc/RUSTSEC-0000-0000.toml +++ b/crates/renderdoc/RUSTSEC-0000-0000.toml @@ -16,7 +16,6 @@ The flaw was corrected in release 0.5.0. patched_versions = [">= 0.5.0"] url = "https://github.com/ebkalderon/renderdoc-rs/pull/32" keywords = ["undefined_behavior"] -affected_os = ["linux", "windows"] affected_functions = [ "renderdoc::api::RenderDocV110::trigger_multi_frame_capture", "renderdoc::api::RenderDocV120::set_capture_file_comments",