From 277934e8914c8897ca5233b84f2dde039af27388 Mon Sep 17 00:00:00 2001 From: Safe4U Date: Sun, 7 Jul 2024 11:38:25 +0800 Subject: [PATCH] Add advisory in workflow-core --- crates/workflow-core/RUSTSEC-0000-0000.md | 26 +++++++++++++++++++++++ 1 file changed, 26 insertions(+) create mode 100644 crates/workflow-core/RUSTSEC-0000-0000.md diff --git a/crates/workflow-core/RUSTSEC-0000-0000.md b/crates/workflow-core/RUSTSEC-0000-0000.md new file mode 100644 index 000000000..99103e66f --- /dev/null +++ b/crates/workflow-core/RUSTSEC-0000-0000.md @@ -0,0 +1,26 @@ +```toml +[advisory] +id = "RUSTSEC-0000-0000" +package = "workflow-core" +date = "2024-07-07" +url = "https://github.com/workflow-rs/workflow-rs/issues/11" +informational = "unsound" +categories = ["memory-exposure", "memory-corruption"] + +[affected.functions] +"workflow_core::utils::buffer_as_slice" = ["<= 0.13.3"] +"workflow_core::utils::buffer_as_slice_mut" = ["<= 0.13.3"] + +[versions] +patched = [] +``` + +# Create illegal slice by util function + +The util functions `buffer_as_slice` and `buffer_as_slice_mut` in crate +`workflow-core` are very powerful and useful to get slice of other types +but are rather unsafe as well: + +1. The pointer calculation with `byte_offset` could lead to alignment problem, which is an undefined behavior. + +2. The `from_raw_parts` could create an out-of-bound slice that allows the user to access or even change the memory illegally.