GitHub Advisoryadvisory · crates.io

GHSA-fq33-vmhv-48xh ntru-rs has unsound FFI: Wrong API usage causes write past allocated area

MEDIUM Published 2023-04-07 Modified 2023-04-07 Official page ↗
Ecosystem
crates.io
Packages
ntru
Severity
Moderate
Reviewed
2023-04-07

Affected packages

• crates.io ntru: >= 0.4.3, <= 0.5.6 (no fix yet)

Description

The following usage causes undefined behavior. ```rust let kp: ntru::types::KeyPair = …; kp.get_public().export(Default::default()) ``` When compiled with debug assertions, the code above will trigger a `attempt to subtract with overflow` panic before UB occurs. Other mistakes (e.g. using `EncParams` from a different key) may always trigger UB. Likely, older versions of this crate are also affected, but have not been tested.

References