From d315a415ce0852a1008a5d356fc7937644166e97 Mon Sep 17 00:00:00 2001 From: github-actions Date: Wed, 29 Jan 2025 19:29:49 +0000 Subject: [PATCH] Update gh-pages --- advisories/RUSTSEC-2025-0002.html | 200 +++++++++++ advisories/RUSTSEC-2025-0003.html | 197 +++++++++++ advisories/index.html | 38 +++ categories/memory-exposure.html | 38 +++ feed.xml | 549 ++++++++++++++++-------------- js/index.js | 4 +- packages/fast-float.html | 19 ++ packages/fast-float2.html | 90 +++++ packages/index.html | 6 + 9 files changed, 874 insertions(+), 267 deletions(-) create mode 100644 advisories/RUSTSEC-2025-0002.html create mode 100644 advisories/RUSTSEC-2025-0003.html create mode 100644 packages/fast-float2.html diff --git a/advisories/RUSTSEC-2025-0002.html b/advisories/RUSTSEC-2025-0002.html new file mode 100644 index 000000000..ad8745d9e --- /dev/null +++ b/advisories/RUSTSEC-2025-0002.html @@ -0,0 +1,200 @@ + + + + + + + +RUSTSEC-2025-0002: fast-float2: Segmentation fault due to lack of bound check › RustSec Advisory Database + + + + + + + + + +
+
+

+ +
+
+ +
+
+ +
+ +
+ +
+
+ + + History ⋅ + Edit ⋅ + JSON (OSV) + + + +
+

+ + RUSTSEC-2025-0002 + +

+

Segmentation fault due to lack of bound check

+ +
+ + + +
+
Reported
+
+ +
+ +
Issued
+
+ + +
+ +
Package
+
+ + + fast-float2 + (crates.io) + + +
+ +
Type
+
+ + Vulnerability + +
+ + +
Categories
+
+ +
+ + + + + + + +
References
+
+ +
+ + + + + + + +
Patched
+
+ +
    + +
  • >=0.2.2
    • + +
+ +
+ + + + + + + + +
+ + + +
+
Affected Functions
+
Version
+ +
fast_float2::common::AsciiStr::first
+
+
    + +
  • <0.2.2
    • + +
+
+ +
+ + + + +

Description

+

In this case, the "fast_float2::common::AsciiStr::first" method within the "AsciiStr" struct +uses the unsafe keyword to reading from memory without performing bounds checking. +Specifically, it directly dereferences a pointer offset by "self.ptr". +Because of the above reason, the method accesses invalid memory address when it takes an empty string as its input. +This approach violates Rust’s memory safety guarantees, as it can lead to invalid memory access if empty buffer is provided.

+ + +

Advisory available under CC0-1.0 + license. + + +

+
+
diff --git a/advisories/RUSTSEC-2025-0003.html b/advisories/RUSTSEC-2025-0003.html new file mode 100644 index 000000000..1f6023773 --- /dev/null +++ b/advisories/RUSTSEC-2025-0003.html @@ -0,0 +1,197 @@ + + + + + + + +RUSTSEC-2025-0003: fast-float: Segmentation fault due to lack of bound check › RustSec Advisory Database + + + + + + + + + +
+
+

+ +
+
+ +
+
+ +
+ +
+ +
+
+ + + History ⋅ + Edit ⋅ + JSON (OSV) + + + +
+

+ + RUSTSEC-2025-0003 + +

+

Segmentation fault due to lack of bound check

+ +
+ + + +
+
Reported
+
+ +
+ +
Issued
+
+ + +
+ +
Package
+
+ + + fast-float + (crates.io) + + +
+ +
Type
+
+ + Vulnerability + +
+ + +
Categories
+
+ +
+ + + + + + + +
References
+
+ +
+ + + + + + + +
Patched
+
+ + no patched versions + +
+ + + + + + + + +
+ + + +
+
Affected Functions
+
Version
+ +
fast_float::common::AsciiStr::first
+
+
    + +
  • *
    • + +
+
+ +
+ + + + +

Description

+

In this case, the "fast_float::common::AsciiStr::first" method within the "AsciiStr" struct +uses the unsafe keyword to reading from memory without performing bounds checking. +Specifically, it directly dereferences a pointer offset by "self.ptr". +Because of the above reason, the method accesses invalid memory address when it takes an empty string as its input. +This approach violates Rust’s memory safety guarantees, as it can lead to invalid memory access if empty buffer is provided.

+

No patched version for fast-float crate has been released, but a patch is available in the fast-float2 fork.

+ + +

Advisory available under CC0-1.0 + license. + + +

+
+
diff --git a/advisories/index.html b/advisories/index.html index 1557caf91..7f40e6ad7 100644 --- a/advisories/index.html +++ b/advisories/index.html @@ -64,6 +64,44 @@