From 5f0bbd36c1a1025852e67cae36af3d5a7c4ce691 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Linus=20F=C3=A4rnstrand?= Date: Thu, 3 Dec 2020 00:45:26 +0100 Subject: [PATCH 1/2] Add advisory on mio SocketAddr casting --- crates/mio/RUSTSEC-0000-0000.md | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) create mode 100644 crates/mio/RUSTSEC-0000-0000.md diff --git a/crates/mio/RUSTSEC-0000-0000.md b/crates/mio/RUSTSEC-0000-0000.md new file mode 100644 index 0000000..22b6c3d --- /dev/null +++ b/crates/mio/RUSTSEC-0000-0000.md @@ -0,0 +1,22 @@ +```toml +[advisory] +id = "RUSTSEC-0000-0000" +package = "mio" +date = "2020-11-02" +url = "https://github.com/tokio-rs/mio/issues/1386" +keywords = ["memory", "layout", "cast"] +informational = "unsound" + +[versions] +patched = [">= 0.7.6"] +``` + +# `mio` invalidly assumes the memory layout of std::net::SocketAddr + +The [`mio`](https://crates.io/crates/mio) crate has assumed `std::net::SocketAddrV4` +and `std::net::SocketAddrV6` have the same memory layout as the system C representation +`sockaddr`. It has simply casted the pointers to convert the socket addresses to the +system representation. The standard library does not say anything about the memory +layout, and this will cause invalid memory access if the standard library +changes the implementation. No warnings or errors will be emitted once the +change happens. \ No newline at end of file From 3d7ea41f31a07d361feb621cfa66d158f215e235 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Linus=20F=C3=A4rnstrand?= Date: Thu, 3 Dec 2020 00:51:55 +0100 Subject: [PATCH 2/2] Add unaffected field for older mio --- crates/mio/RUSTSEC-0000-0000.md | 1 + 1 file changed, 1 insertion(+) diff --git a/crates/mio/RUSTSEC-0000-0000.md b/crates/mio/RUSTSEC-0000-0000.md index 22b6c3d..4e87317 100644 --- a/crates/mio/RUSTSEC-0000-0000.md +++ b/crates/mio/RUSTSEC-0000-0000.md @@ -9,6 +9,7 @@ informational = "unsound" [versions] patched = [">= 0.7.6"] +unaffected = ["< 0.7.0"] ``` # `mio` invalidly assumes the memory layout of std::net::SocketAddr