esp-rs / espup

Tool for installing and maintaining Espressif Rust ecosystem.
Apache License 2.0
232 stars 24 forks source link

RUSTSEC-2024-0357: `MemBio::get_buf` has undefined behavior with empty buffers #450

Closed github-actions[bot] closed 1 month ago

github-actions[bot] commented 1 month ago

MemBio::get_buf has undefined behavior with empty buffers

Details
Package openssl
Version 0.10.64
URL https://github.com/sfackler/rust-openssl/pull/2266
Date 2024-07-21
Patched versions >=0.10.66

Previously, MemBio::get_buf called slice::from_raw_parts with a null-pointer, which violates the functions invariants, leading to undefined behavior. In debug builds this would produce an assertion failure. This is now fixed.

See advisory page for additional details.