GitHub Advisoryadvisory · crates.io
GHSA-pmcv-mgcf-rvxg Non-aligned u32 read in Chacha20 encryption and decryption
HIGH
Official page ↗
- Ecosystem
- crates.io
- Packages
- crypto2
- Severity
- High
- Reviewed
- 2022-06-16
Affected packages
• crates.io crypto2: <= 0.1.2 (no fix yet)
Description
The implementation does not enforce alignment requirements on input slices while incorrectly assuming 4-byte alignment through an unsafe call to `std::slice::from_raw_parts_mut`, which breaks the contract and introduces undefined behavior.
This affects Chacha20 encryption and decryption in crypto2.