Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

crates.io package

ferris-says

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Unratedcrates.ioPublished

    ferris-says has undefined behavior when not using UTF-8

    GHSA-v363-rrf2-5fmj

    Affected
    • crates.io ferris-says >= 0.1.2, <= 0.2.1; >= 0.3.0, < 0.3.1
    Fixed in
    0.3.1· Partial vendor fix
    Issue
    Affected versions receive a &[u8] from the caller through a safe API, and pass it directly to the unsafe str::fromutf8unchecked function. The behavior of ferrissays::say is undefined if the bytes from the caller don't happen to be valid UTF-8. The flaw was corrected in [ferris-says#21] by using the safe str::fromutf8 instead, and returning an error on invalid input. However this fix has not yet been published to crates.io as a patch version for 0.2. Separately, [ferris-says#32] has introduced a different API for version 0.3 which accepts input as &str rather than &[u8], so is unaffected by this bug. [ferris-says#21]: https://github.com/rust-lang/ferris-says/pull/21 [ferris-says#32]: https://github.com/rust-lang/ferris-says/pull/32

    Recommended action: Upgrade to 0.3.1; some affected versions have no fix yet, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →