GitHub Advisoryadvisory · crates.io

GHSA-q445-7m23-qrmw openssl's `MemBio::get_buf` has undefined behavior with empty buffers

MEDIUM Published 2024-07-22 Modified 2024-07-22 Official page ↗
Ecosystem
crates.io
Packages
openssl
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Weaknesses
CWE-476
Reviewed
2024-07-22

Affected packages

• crates.io openssl: < 0.10.66 → fixed in 0.10.66

Description

Previously, `MemBio::get_buf` called `slice::from_raw_parts` with a null-pointer, which violates the functions invariants, leading to undefined behavior. In debug builds this would produce an assertion failure. This is now fixed.

Related

Weakness · CWE (1)

  • CWE-476 NULL Pointer Dereference weakness

References