GitHub Advisoryadvisory · crates.io
GHSA-fq33-vmhv-48xh ntru-rs has unsound FFI: Wrong API usage causes write past allocated area
MEDIUM
Official page ↗
- Ecosystem
- crates.io
- Packages
- ntru
- Severity
- Moderate
- Reviewed
- 2023-04-07
Affected packages
• crates.io ntru: >= 0.4.3, <= 0.5.6 (no fix yet)
Description
The following usage causes undefined behavior.
```rust
let kp: ntru::types::KeyPair = …;
kp.get_public().export(Default::default())
```
When compiled with debug assertions, the code above will trigger a `attempt to subtract with overflow` panic before UB occurs.
Other mistakes (e.g. using `EncParams` from a different key) may always trigger UB.
Likely, older versions of this crate are also affected, but have not been tested.