GitHub Advisoryadvisory · crates.io

GHSA-j39j-6gw9-jw6h git2 has potential undefined behavior when dereferencing Buf struct

LOW Published 2026-02-04 Modified 2026-02-04 Official page ↗
Ecosystem
crates.io
Packages
git2
Severity
Low
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U
Weaknesses
CWE-476
Reviewed
2026-02-04

Affected packages

• crates.io git2: < 0.20.4 → fixed in 0.20.4

Description

If the Buf struct is dereferenced immediately after calling new() or default() on the Buf struct, a null pointer is passed to the unsafe function slice::from_raw_parts. According to the safety section documentation of the function, data must be non-null and aligned even for zero-length slices or slices of ZSTs. Thus, passing a null pointer will lead to undefined behavior.

Related

Weakness · CWE (1)

  • CWE-476 NULL Pointer Dereference weakness

References