1 matches found
WebAssembly allocator shim corrupts memory on allocation failure
On wasm32, zstd-sys provides malloc and free to the C library through a shim over Rust's allocator. The shim did not check for allocation failure: it wrote its size header to address 0 and returned address 4, which the C library used as a valid buffer. freeNULL also read below address 0. Whenever...
6.1AI score
SaveExploits0Affected Software1
20