VDB
Sign up
—

RUSTSEC-2023-0080

Buffer overflow due to integer overflow in `transpose`

Details

Given the function `transpose::transpose`: ```rust fn transpose<T: Copy>(input: &[T], output: &mut [T], input_width: usize, input_height: usize) ```

The safety check `input_width * input_height == output.len()` can fail due to `input_width * input_height` overflowing in such a way that it equals `output.len()`. As a result of failing the safety check, memory past the end of `output` is written to. This only occurs in release mode since `*` panics on overflow in debug mode.

Exploiting this issue requires the caller to pass `input_width` and `input_height` arguments such that multiplying them overflows, and the overflown result equals the lengths of input and output slices.

Are you affected?

Enter the version of the package you're using.

Affected packages

crates.io/transpose
Introduced in: 0.0.0-0Fixed in: 0.2.3

Upgrade transpose to 0.2.3 or newer (ecosystem crates.io).

References