Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

crates.io package

zstd-sys

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Unratedcrates.ioPublished

    WebAssembly allocator shim corrupts memory on allocation failure

    Affected
    • crates.io zstd-sys >= 2.0.9, < 2.1.2
    Fixed in
    2.1.2· Vendor fix available
    Issue
    On wasm32, zstd-sys provides `malloc` and `free` to the C library through a shim over Rust's allocator. The shim did not check for allocation failure: it wrote its size header to address 0 and returned address 4, which the C library used as a valid buffer. `free(NULL)` also read below address 0. Whenever the instance cannot grow its memory by what a frame asks for, a small crafted frame (a 9-byte header declaring a 128 MiB window is enough) made decompression write decoded data over the bottom of the module's linear memory, instead of failing. The corruption stays within the wasm sandbox. The flaw was corrected by returning NULL on allocation failure or size overflow, and by making `free(NULL)` a no-op.

    Recommended action: Upgrade to 2.1.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.devSource checked Evidence →