GitHub Advisoryadvisory · crates.io

GHSA-5gmm-6m36-r7jh transpose: Buffer overflow due to integer overflow

MEDIUM Published 2024-04-05 Modified 2025-07-28 Official page ↗
Aliases
CVE-2023-53156
Ecosystem
crates.io
Packages
transpose
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L
Weaknesses
CWE-120, CWE-190
Reviewed
2024-04-05

Affected packages

• crates.io transpose: >= 0.1.0, < 0.2.3 → fixed in 0.2.3

Description

Given the function `transpose::transpose`: ```rust fn transpose(input: &[T], output: &mut [T], input_width: usize, input_height: usize) ``` The safety check `input_width * input_height == output.len()` can fail due to `input_width * input_height` overflowing in such a way that it equals `output.len()`. As a result of failing the safety check, memory past the end of `output` is written to. This only occurs in release mode since `*` panics on overflow in debug mode. Exploiting this issue requires the caller to pass `input_width` and `input_height` arguments such that multiplying them overflows, and the overflown result equals the lengths of input and output slices.

Related

Alias · CVE (1)

  • CVE-2023-53156 The transpose crate before 0.2.3 for Rust allows an integer overflow via input_width and input_height arguments. vulnerability

Weakness · CWE (2)

  • CWE-120 Buffer Copy without Checking Size of Input weakness
  • CWE-190 Integer Overflow or Wraparound weakness

References