Advisory Database
  • Advisories
  • Dependency Scanning
  1. cargo
  2. ›
  3. ruzstd
  4. ›
  5. GHSA-x3f4-45xf-rjm7

GHSA-x3f4-45xf-rjm7: `ruzstd` uninit and out-of-bounds memory reads

December 2, 2024

Affected versions of ruzstd miscalculate the length of the allocated and init section of its internal RingBuffer, leading to uninitialized or out-of-bounds reads in copy_bytes_overshooting of up to 15 bytes.

This may result in up to 15 bytes of memory contents being written into the decoded data when decompressing a crafted archive. This may occur multiple times per archive.

References

  • github.com/KillingSpark/zstd-rs
  • github.com/KillingSpark/zstd-rs/issues/75
  • github.com/KillingSpark/zstd-rs/pull/76
  • github.com/advisories/GHSA-x3f4-45xf-rjm7
  • rustsec.org/advisories/RUSTSEC-2024-0400.html

Code Behaviors & Features

Detect and mitigate GHSA-x3f4-45xf-rjm7 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions starting from 0.7.0 before 0.7.3

Fixed versions

  • 0.7.3

Solution

Upgrade to version 0.7.3 or above.

Weakness

  • CWE-125: Out-of-bounds Read

Source file

cargo/ruzstd/GHSA-x3f4-45xf-rjm7.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Wed, 14 May 2025 12:16:13 +0000.