Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

RUSTSEC-2023-0075: Unaligned write of u64 on 32-bit and 16-bit platforms #4

Open
github-actions bot opened this issue Dec 21, 2023 · 0 comments

Comments

@github-actions
Copy link

github-actions bot commented Dec 21, 2023

Details
Package unsafe-libyaml
Version 0.2.9
Warning unsound
URL dtolnay/unsafe-libyaml#21
Patched Versions >=0.2.10
Aliases GHSA-r24f-hg58-vfrw

Affected versions allocate memory using the alignment of usize and write data
to it of type u64, without using core::ptr::write_unaligned. In platforms
with sub-64bit alignment for usize (including wasm32 and x86) these writes
are insufficiently aligned some of the time.

If using an ordinary optimized standard library, the bug exhibits Undefined
Behavior so may or may not behave in any sensible way, depending on
optimization settings and hardware and other things. If using a Rust standard
library built with debug assertions enabled, the bug manifests deterministically
in a crash (non-unwinding panic) saying "ptr::write requires that the pointer
argument is aligned and non-null"
.

No 64-bit platform is impacted by the bug.

The flaw was corrected by allocating with adequately high alignment on all
platforms.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

0 participants