search

ImageOptim / mozjpeg-rust

Safe Rust wrapper for the MozJPEG library
https://lib.rs/mozjpeg
Other
75 stars 19 forks source link

DecompressScanlines::read_scanlines is unsound #10

Closed HeroicKatora closed 4 years ago

HeroicKatora commented 4 years ago

https://docs.rs/mozjpeg/0.8.17/mozjpeg/decompress/struct.DecompressStarted.html#method.read_scanlines

This method will write arbitrary, user controlled bytes into a slice of T: Copy. This can lead to invalid instances of T to be returned. Same reason as rgb but without the 'static bound so a little different. This can be used to decode scanlines into a Vec<&'static u8> or something along those lines and dereference some arbitrary memory with a crafted input file. No writable variant this time.

kornelski commented 4 years ago

Thanks. It's going to be plain crate again. I'm waiting for https://github.com/randomites/plain/pull/6 because I've noticed that crate has a big omission in impls.

kornelski commented 4 years ago

Fixed in 0.8.19