GitHub Advisoryadvisory · crates.io

GHSA-x3f4-45xf-rjm7 `ruzstd` uninit and out-of-bounds memory reads

MEDIUM Published 2024-12-02 Modified 2024-12-02 Official page ↗
Ecosystem
crates.io
Packages
ruzstd
Severity
Moderate
Weaknesses
CWE-125
Reviewed
2024-12-02

Affected packages

• crates.io ruzstd: >= 0.7.0, < 0.7.3 → fixed in 0.7.3

Description

Affected versions of `ruzstd` miscalculate the length of the allocated and init section of its internal `RingBuffer`, leading to uninitialized or out-of-bounds reads in `copy_bytes_overshooting` of up to 15 bytes. This may result in up to 15 bytes of memory contents being written into the decoded data when decompressing a crafted archive. This may occur multiple times per archive.

Related

Weakness · CWE (1)

  • CWE-125 Out-of-bounds Read weakness

References