Lucene search

K
osvGoogleOSV:RUSTSEC-2021-0022
HistoryFeb 09, 2021 - 12:00 p.m.

Use-after-free in `subscript_next` and `subscript_prev` wrappers

2021-02-0912:00:00
Google
osv.dev
7

0.005 Low

EPSS

Percentile

77.0%

Affected versions of this crate had an unsound implementation which could pass
a pointer to freed memory to ydb_subscript_next_st and
ydb_subscript_prev_st if the variable and subscripts did not have enough
memory allocated on the first call to hold the next variable in the database.

For example, the following code had undefined behavior:

let mut key = Key::variable(String::from("a"));
Key::variable("averylongkeywithlotsofletters")
    .set_st(YDB_NOTTP, Vec::new(), b"some val")
    .unwrap();
key.sub_next_self_st(YDB_NOTTP, Vec::new()).unwrap();

yottadb has no reverse-dependencies on crates.io and there are no known
instances of this API being used incorrectly in practice. The fix is backwards
compatible.

The flaw was corrected by recalculating the pointer each time it was reallocated.

CPENameOperatorVersion
yottadblt1.2.0

0.005 Low

EPSS

Percentile

77.0%

Related for OSV:RUSTSEC-2021-0022