GitHub Advisoryadvisory · crates.io
GHSA-5gmm-6m36-r7jh transpose: Buffer overflow due to integer overflow
MEDIUM
Official page ↗
- Aliases
- CVE-2023-53156
- Ecosystem
- crates.io
- Packages
- transpose
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L
- Weaknesses
- CWE-120, CWE-190
- Reviewed
- 2024-04-05
Affected packages
• crates.io transpose: >= 0.1.0, < 0.2.3 → fixed in 0.2.3
Description
Given the function `transpose::transpose`:
```rust
fn transpose(input: &[T], output: &mut [T], input_width: usize, input_height: usize)
```
The safety check `input_width * input_height == output.len()` can fail due to `input_width * input_height` overflowing in such a way that it equals `output.len()`.
As a result of failing the safety check, memory past the end of `output` is written to. This only occurs in release mode since `*` panics on overflow in debug mode.
Exploiting this issue requires the caller to pass `input_width` and `input_height` arguments such that multiplying them overflows, and the overflown result equals the lengths of input and output slices.
Related
Alias · CVE (1)
- CVE-2023-53156 The transpose crate before 0.2.3 for Rust allows an integer overflow via input_width and input_height arguments. vulnerability