- Reported
-
- Issued
-
- Package
-
dbn
(crates.io)
- Type
-
Vulnerability
- Categories
-
- Keywords
-
#Heap-Buffer-Overflow
- References
-
- Patched
-
Description
The heap-buffer-overflow is triggered in the strlen() function when handling the c_chars_to_str function in the dbn crate. This vulnerability occurs because the CStr::from_ptr() function in Rust assumes that the provided C string is null-terminated. However, there is no guarantee that the input chars array passed to the c_chars_to_str function is properly null-terminated.
If the chars array does not contain a null byte (\0), strlen() will continue to read beyond the bounds of the buffer in search of a null terminator. This results in an out-of-bounds memory read and can lead to a heap-buffer-overflow, potentially causing memory corruption or exposing sensitive information.
Advisory available under CC0-1.0
license.