Medium, CVSS 6.9crates.ioPublished
Unsoundness in Iterator and DoubleEndedIterator impls for glib::VariantStrIter
GHSA-wrw7-89jp-8q8g
- Affected
- crates.io glib >= 0.15.0, < 0.20.0
- Fixed in
- 0.20.0· Vendor fix available
- Issue
- The VariantStrIter::implget function (called internally by implementations of the Iterator and DoubleEndedIterator traits for this type) was unsound, resulting in undefined behaviour. An immutable reference &p to a mut libc::cchar pointer initialized to NULL was passed as an argument to a C function that that mutates the pointer behind &p in-place (i.e. as an out-argument), which was unsound. After changes in recent versions of the Rust compiler, these unsound writes through &p now seem to be completely disregarded when building the glib crate with optimizations. This subsequently caused all calls of VariantStrIter::implget to violate the safety requirements of the std::ffi::CStr::fromptr function - which requires its argument to be a valid pointer to a C-style string - resulting in crashes due to NULL pointer dereferences. This was fixed by passing the out-argument pointer explitly as &mut p instead of &p. This issue has been present since this code was initially added in glib…
Recommended action: Upgrade to 0.20.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.