GitHub Advisoryadvisory · crates.io
GHSA-qm2p-4w45-v2vr grcov has an out of bounds write triggered by crafted coverage data
MEDIUM
Official page ↗
- Ecosystem
- crates.io
- Packages
- grcov
- Severity
- Moderate
- Weaknesses
- CWE-787
- Reviewed
- 2025-02-10
Affected packages
• crates.io grcov: < 0.8.20 → fixed in 0.8.20
Description
Function `grcov::covdir::get_coverage` uses the `unsafe` function `get_unchecked_mut` without validating that the index is in bounds.
This results in memory corruption, and could potentially allow arbitrary code execution provided that an attacker can feed the tool crafted coverage data.
Related
Weakness · CWE (1)
- CWE-787 Out-of-bounds Write weakness