Reported

September 22, 2026

Issued

September 22, 2026

Package

stack-graphs (crates.io)

Type

INFO Unsound

Categories

• memory-corruption

Keywords

#ffi #extern-c

References

• https://github.com/rustsec/advisory-db/issues/3241
• https://github.com/github/stack-graphs

Patched

no patched versions

Unaffected

• <=0.0.2

Affected Functions

Version

stack_graphs::c::sg_stack_graph_free

• >=0.0.3

Description

stack_graphs::c is a public module. From 0.0.3 through the current crates.io release 0.14.1, its pointer-taking entry points are pub extern "C" fn rather than unsafe fn. Safe Rust can call them.

sg_stack_graph_free frees the pointer with Box::from_raw. sg_stack_graph_free(std::ptr::null_mut()) is immediate undefined behavior. The same shape is used by the other *_free exports and by getters and mutators that dereference the caller-supplied pointer or pass it to from_raw_parts (sg_stack_graph_nodes, sg_stack_graph_add_edges, and the rest of the pointer-taking functions in src/c.rs). Constructors that take no pointer are not part of this issue.

The upstream repository is archived, so a fix cannot be filed there and no patched release exists. The soundness fix is to make every pointer-taking export unsafe extern "C" fn, with a safety comment that the pointer is non-null and, for free, came from the matching constructor.

Advisory available under CC0-1.0 license.