1 line
1.8 KiB
JSON
1 line
1.8 KiB
JSON
{"schema_version":"1.7.3","id":"RUSTSEC-2025-0143","published":"2025-12-24T12:00:00Z","modified":"2026-01-29T06:11:15.854620Z","aliases":["GHSA-5w5r-mf82-595p"],"summary":"Unsound APIs of public `constant::Reader` and `StructSchema`","details":"The safe API functions `constant::Reader::get` and `StructSchema::new` rely on `PointerReader::get_root_unchecked`, which can cause undefined behavior (UB) by constructing arbitrary words or schemas.\n\n## `Reader::get`\n\n```rust\npub fn get(&self) -> Result<<T as Owned>::Reader<'static>> {\n // ...\n // UNSAFE: access `words` without validation\n}\n```\n\n## `StructSchema::new`\n\n```rust\npub fn new(builder: RawBrandedStructSchema) -> StructSchema {\n // ...\n // UNSAFE: access encoded nodes without validation\n}\n```\n\nThis vulnerability allows safe Rust code to trigger UB, which violates Rust's safety guarantees.\n\nThe issue is resolved in version `0.24.0` by making constructor functions unsafe and mark the fields of struct as visible only in the crate.","affected":[{"package":{"name":"capnp","ecosystem":"crates.io","purl":"pkg:cargo/capnp"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.24.0"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"arch":[],"functions":["capnp::constant::Reader::get","capnp::schema::StructSchema::new"],"os":[]}},"database_specific":{"categories":["memory-corruption"],"cvss":null,"informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2025-0143.json"}}],"references":[{"type":"PACKAGE","url":"https://crates.io/crates/capnp"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2025-0143.html"},{"type":"REPORT","url":"https://github.com/capnproto/capnproto-rust/issues/605"}],"database_specific":{"license":"CC0-1.0"}} |