From dce21838a86955a57e688f6fe59af531fc5f4bdb Mon Sep 17 00:00:00 2001 From: Cai Bear Date: Sat, 17 Feb 2024 09:38:56 -0800 Subject: [PATCH] Add advisory for buffer overflow in transpose (#1890) * Create transpose/RUSTSEC-0000-0000.md * Fix typo * Fix typo * Fix `affected` specification * Add a note about exploitation requirements * Clarify exploitation conditions --------- Co-authored-by: Sergey "Shnatsel" Davidoff --- crates/transpose/RUSTSEC-0000-0000.md | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) create mode 100644 crates/transpose/RUSTSEC-0000-0000.md diff --git a/crates/transpose/RUSTSEC-0000-0000.md b/crates/transpose/RUSTSEC-0000-0000.md new file mode 100644 index 0000000..bd8e302 --- /dev/null +++ b/crates/transpose/RUSTSEC-0000-0000.md @@ -0,0 +1,26 @@ +```toml +[advisory] +id = "RUSTSEC-0000-0000" +package = "transpose" +date = "2023-12-18" +url = "https://github.com/ejmahler/transpose/issues/11" +categories = ["memory-corruption"] + +[versions] +patched = [] + +[affected] +functions = { "transpose::transpose" = [">= 0.1.0"] } +``` + +# Buffer overflow due to integer overflow in `transpose` + +Given the function `transpose::transpose`: +```rust +fn transpose(input: &[T], output: &mut [T], input_width: usize, input_height: usize) +``` + +The safety check `input_width * input_height == output.len()` can fail due to `input_width * input_height` overflowing in such a way that it equals `output.len()`. +As a result of failing the safety check, memory past the end of `output` is written to. This only occurs in release mode since `*` panics on overflow in debug mode. + +Exploiting this issue requires the caller to pass `input_width` and `input_height` arguments such that multiplying them overflows, and the overflown result equals the lengths of input and output slices.