From c29b239a56cdc4175f726783262f9e8ee5bdd4bd Mon Sep 17 00:00:00 2001 From: Konrad Borowski Date: Wed, 27 Apr 2022 19:55:44 +0200 Subject: [PATCH] Add advisory for using impure constants in array-macro (#1224) --- crates/array-macro/RUSTSEC-0000-0000.md | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) create mode 100644 crates/array-macro/RUSTSEC-0000-0000.md diff --git a/crates/array-macro/RUSTSEC-0000-0000.md b/crates/array-macro/RUSTSEC-0000-0000.md new file mode 100644 index 0000000..b69a3b6 --- /dev/null +++ b/crates/array-macro/RUSTSEC-0000-0000.md @@ -0,0 +1,21 @@ +```toml +[advisory] +id = "RUSTSEC-0000-0000" +package = "array-macro" +date = "2022-04-27" +url = "https://gitlab.com/KonradBorowski/array-macro/-/issues/5" +categories = ["code-execution", "memory-corruption", "memory-exposure"] +informational = "unsound" + +[versions] +patched = [">= 2.1.2"] +unaffected = ["< 2.1.0"] +``` + +# `array!` macro is unsound when its length is impure constant + +Affected versions of this crate did substitute the array length provided by an user at compile-time multiple times. + +When an impure constant expression is passed as an array length (such as a result of an impure procedural macro), this can result in the initialization of an array with uninitialized types, which in turn can allow an attacker to execute arbitrary code. + +The flaw was corrected in commit [d5b63f72](https://gitlab.com/KonradBorowski/array-macro/-/commit/d5b63f72090f3809c21ac28f9cfd84f12559bf7d) by making sure that array length is substituted just once.