Medium, CVSS 6.3crates.ioAmendedPublished
block_buffer: panic corrupts inline buffer position
GHSA-qwgh-2vcv-g2f7
- Affected
- crates.io block_buffer >= 0.11.0, < 0.12.1
- Fixed in
- 0.12.1· Vendor fix available
- Issue
- A caught panic may leave the cursor position of `EagerBuffer` or `ReadBuffer` in a corrupted state; this in turn allows out-of-bounds reads/writes. Details & PoC The following two tests fail miri: ```rust #[cfg(miri)] #[test] fn eager_digest_blocks_panic_corrupts_inline_position() { // `EagerBuffer` stores its cursor in the last byte of the internal block. // When `digest_blocks` completes a previously partial block, it overwrites // that byte with input data before invoking the caller-provided `compress` // callback. If the callback panics, safe code can catch the panic and keep // using the buffer while its cursor byte no longer satisfies the internal // `pos ::new(&[1, 2]); let _ = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| { buf.digest_blocks(&[3, 0xff], |_| panic!("simulated compression failure")); })); let _ = buf.get_pos(); } #[cfg(miri)] #[test] fn read_buffer_generator_panic_corrupts_inline_position() { // `ReadBuffer` stores its cursor in…
Recommended action: Upgrade to 0.12.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.