Lucene search

K
osvGoogleOSV:RUSTSEC-2021-0008
HistoryJan 02, 2021 - 12:00 p.m.

reading on uninitialized buffer can cause UB (`impl<R> BufRead for GreedyAccessReader<R>`)

2021-01-0212:00:00
Google
osv.dev
15
buffer overread
uninitialized memory
rust code
crate vulnerability

EPSS

0.005

Percentile

75.6%

Affected versions of this crate creates an uninitialized buffer and passes it to user-provided Read implementation.

This is unsound, because it allows safe Rust code to exhibit an undefined behavior (read from uninitialized memory).

The flaw was corrected in version 0.1.1 by zero-initializing a newly allocated buffer
before handing it to a user-provided Read implementation.

EPSS

0.005

Percentile

75.6%

Related for OSV:RUSTSEC-2021-0008