GitHub Advisoryadvisory · crates.io

GHSA-927q-g9w9-pm54 Panic in mp3-metadata due to the lack of bounds checking

MEDIUM Published 2025-04-30 Modified 2025-04-30 Official page ↗
Ecosystem
crates.io
Packages
mp3-metadata
Severity
Moderate
CVSS vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P
Weaknesses
CWE-119
Reviewed
2025-04-30

Affected packages

• crates.io mp3-metadata: < 0.4.0 → fixed in 0.4.0

Description

The `get_id3()` methods used by `mp3_metadata::read_from_slice()` does not perform adequate bounds checking when recreating the tag due to the use of desynchronization. Fixed in Fix index error, released as part of 0.4.0.

Related

Weakness · CWE (1)

  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer weakness

References