GitHub Advisoryadvisory · crates.io
GHSA-j39j-6gw9-jw6h git2 has potential undefined behavior when dereferencing Buf struct
LOW
Official page ↗
- Ecosystem
- crates.io
- Packages
- git2
- Severity
- Low
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U
- Weaknesses
- CWE-476
- Reviewed
- 2026-02-04
Affected packages
• crates.io git2: < 0.20.4 → fixed in 0.20.4
Description
If the Buf struct is dereferenced immediately after calling new() or default() on the Buf struct, a null pointer is passed to the unsafe function slice::from_raw_parts. According to the safety section documentation of the function, data must be non-null and aligned even for zero-length slices or slices of ZSTs. Thus, passing a null pointer will lead to undefined behavior.
Related
Weakness · CWE (1)
- CWE-476 NULL Pointer Dereference weakness