GHSA-g98v-hv3f-hcfr: atty potential unaligned read

June 30, 2023 (updated February 14, 2024)

On windows, atty dereferences a potentially unaligned pointer.

In practice however, the pointer won’t be unaligned unless a custom global allocator is used.

In particular, the System allocator on windows uses HeapAlloc, which guarantees a large enough alignment.

References

github.com/advisories/GHSA-g98v-hv3f-hcfr
github.com/softprops/atty
github.com/softprops/atty/issues/50
github.com/softprops/atty/pull/51
rustsec.org/advisories/RUSTSEC-2021-0145.html

Code Behaviors & Features

Detect and mitigate GHSA-g98v-hv3f-hcfr with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →