RUSTSEC-2023-0080
Buffer overflow due to integer overflow in `transpose`
Details
Given the function `transpose::transpose`: ```rust fn transpose<T: Copy>(input: &[T], output: &mut [T], input_width: usize, input_height: usize) ```
The safety check `input_width * input_height == output.len()` can fail due to `input_width * input_height` overflowing in such a way that it equals `output.len()`. As a result of failing the safety check, memory past the end of `output` is written to. This only occurs in release mode since `*` panics on overflow in debug mode.
Exploiting this issue requires the caller to pass `input_width` and `input_height` arguments such that multiplying them overflows, and the overflown result equals the lengths of input and output slices.
Are you affected?
Enter the version of the package you're using.
Affected packages
0.0.0-0Fixed in: 0.2.3Upgrade transpose to 0.2.3 or newer (ecosystem crates.io).