VDB
EN

RUSTSEC-2024-0404

Unsoundness in anstream

상세

When given a valid UTF8 string "ö\x1b😀", the function in crates/anstream/src/adapter/strip.rs will be confused. The UTF8 bytes are \xc3\xb6 then \x1b then \xf0\x9f\x98\x80.

When looping over "non-printable bytes" \x1b\xf0 will be considered as some non-printable sequence.

This will produce a broken str from the incorrectly segmented bytes via str::from_utf8_unchecked, and that should never happen.

Full credit goes to [@Ralith](https://github.com/Ralith) who reviewed this code and asked [@burakemir](https://github.com/burakemir) to follow up.

이 버전이 영향받나요?

사용 중인 패키지 버전을 입력하면 즉시 평가합니다.

영향 패키지

crates.io / anstream
최초 영향 버전: 0.0.0-0 수정 버전: 0.6.8

Upgrade anstream to 0.6.8 or newer (ecosystem crates.io).

참고