Skip to content

Commit

Permalink
Add ascii advisory (#1618)
Browse files Browse the repository at this point in the history
* Add ascii advisory

* Strip unnecessary comments

* Fix version range specification and category

* Change fixed version specification to `>= 0.9.3`

---------

Co-authored-by: Sergey "Shnatsel" Davidoff <shnatsel@gmail.com>
  • Loading branch information
KisaragiEffective and Shnatsel committed Feb 25, 2023
1 parent 0e63414 commit 6e74bc0
Showing 1 changed file with 19 additions and 0 deletions.
19 changes: 19 additions & 0 deletions crates/ascii/RUSTSEC-0000-0000.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,19 @@
```toml
[advisory]
id = "RUSTSEC-0000-0000"
package = "ascii"
date = "2023-02-25"
url = "https://github.com/tomprogrammer/rust-ascii/issues/64"
informational = "unsound"
categories = ["memory-corruption"]
keywords = ["ascii"]
[versions]
patched = [">= 0.9.3"]
unaffected = ["<= 0.6.0"]
```

# Ascii allows out-of-bounds array indexing in safe code

Affected version of this crate had implementation of `From<&mut AsciiStr>` for `&mut [u8]` and `&mut str`. This can result in out-of-bounds array indexing in safe code.

The flaw was corrected in commit [8a6c779](https://github.com/tomprogrammer/rust-ascii/pull/63/commits/8a6c7798c202766bd57d70fb8d12739dd68fb9dc) by removing those impls.

0 comments on commit 6e74bc0

Please sign in to comment.