MEDIUM
GHSA-fq33-vmhv-48xh
ntru-rs has unsound FFI: Wrong API usage causes write past allocated area
Details
The following usage causes undefined behavior. ```rust let kp: ntru::types::KeyPair = …; kp.get_public().export(Default::default()) ```
When compiled with debug assertions, the code above will trigger a `attempt to subtract with overflow` panic before UB occurs. Other mistakes (e.g. using `EncParams` from a different key) may always trigger UB.
Likely, older versions of this crate are also affected, but have not been tested.
Are you affected?
Enter the version of the package you're using.
Affected packages
crates.io/ntru
Introduced in:
0.4.3No fixed version published yet for ntru. Pin to a known-safe version or switch to an alternative.