Add advisory for flatbuffers

This commit is contained in:
Eduardo Sánchez Muñoz
2020-04-11 13:25:30 +02:00
parent eaa3243b39
commit cbeef93cf0

View File

@@ -0,0 +1,31 @@
[advisory]
id = "RUSTSEC-0000-0000"
package = "flatbuffers"
date = "2020-04-11"
title = "`read_scalar` and `read_scalar_at` are unsound`"
url = "https://github.com/google/flatbuffers/issues/5825"
description = """
The `read_scalar` and `read_scalar_at` functions are unsound
because the allow transmuting values without `unsafe` blocks.
The following example shows how to create a dangling reference:
```
fn main() {
#[derive(Copy, Clone, PartialEq, Debug)]
struct S(&'static str);
impl flatbuffers::EndianScalar for S {
fn to_little_endian(self) -> Self { self }
fn from_little_endian(self) -> Self { self }
}
println!("{:?}", flatbuffers::read_scalar::<S>(&[1; std::mem::size_of::<S>()]));
}
```
"""
[affected.functions]
"flatbuffers::read_scalar" = []
"flatbuffers::read_scalar_at" = []
[versions]
patched = []