GitHub Advisoryadvisory · crates.io

GHSA-q948-x8rf-888m os_str_bytes relies on undefined behavior of `char::from_u32_unchecked`

HIGH Published 2021-08-25 Modified 2023-06-13 Official page ↗
Aliases
CVE-2020-35865
Ecosystem
crates.io
Packages
os_str_bytes
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-704
Reviewed
2021-08-19

Affected packages

• crates.io os_str_bytes: < 2.0.0 → fixed in 2.0.0

Description

The Windows implementation of this crate relied on the behavior of std::char::from_u32_unchecked when its safety clause is violated. Even though this worked with Rust versions up to 1.42 (at least), that behavior could change with any new Rust version, possibly leading a security issue. The flaw was corrected in version 2.0.0.

Related

Alias · CVE (1)

  • CVE-2020-35865 An issue was discovered in the os_str_bytes crate before 2.0.0 for Rust. vulnerability

Weakness · CWE (1)

  • CWE-704 Incorrect Type Conversion or Cast weakness

References