Reported

July 4, 2020

Issued

August 31, 2022 (last modified: June 13, 2023)

Package

mozjpeg (crates.io)

Type

INFO Unsound

Categories

• memory-corruption

Keywords

#type-confusion

Aliases

• GHSA-v8gq-5grq-9728

References

• https://github.com/ImageOptim/mozjpeg-rust/issues/10
• https://github.com/kornelski/rust-rgb/issues/35
• https://rustsec.org/advisories/RUSTSEC-2020-0029.html

Patched

• >=0.8.19

Affected Functions

Version

mozjpeg::DecompressScanlines::read_scanlines

• <0.8.19

Description

This issue and vector is similar to RUSTSEC-2020-0029 of rgb crate which mozjpeg depends on.

Affected versions of mozjpeg crate allow creating instances of any type T from bytes, and do not correctly constrain T to the types for which it is safe to do so.

Examples of safety violation possible for a type T:

• T contains a reference type, and it constructs a pointer to an invalid, arbitrary memory address.
• T requires a safety and/or validity invariant for its construction that may be violated.

The issue was fixed in 0.8.19 by using safer types and involving rgb dependency bump.

Advisory available under CC0-1.0 license.