Add advisory for stainless_ffmpeg FormatContext stream_index unsoundness

[sisy2020]

Affected crate(s)

• stainless_ffmpeg (634 recent downloads per crates.io)

Links to upstream issue(s) or PR(s)

• Upstream issue: Possible unsound APIs nomalab/stainless-ffmpeg#63
• Fix PR: mark functions with stream_index parameter in FormatContext as unsafe nomalab/stainless-ffmpeg#64
• Fix commit: nomalab/stainless-ffmpeg@a649e8c

Severity

This advisory classifies the issue as informational unsound. Affected versions exposed safe public FormatContext methods that accepted a stream_index parameter and used it in unsafe pointer operations without checking whether the index was valid. Safe callers could pass a negative or out-of-bounds stream_index, which could trigger undefined behavior without using unsafe.

The issue was fixed upstream in 0.6.0 by marking the affected methods as unsafe and documenting the caller's safety requirement.

Checklist

• Advisory filename(s) starts with RUSTSEC-0000-0000 as the ID
• date field is set to the public disclosure date
• Contains a concise and descriptive title after advisory metadata
• Asked maintainer(s) if publishing an advisory is appropriate

[djc]

Waiting for maintainer confirmation.

[sisy2020]

Hi, just a gentle ping on this PR. The upstream maintainer was asked about the RustSec advisory, but I haven't received a response so far.
The underlying issue was confirmed by the maintainer and fixed in version 0.6.0. Since it has been a while, would you prefer to proceed with the advisory, or should we close this PR?
Thanks!

[djc]

Pinged the maintainers in the upstream issue.

[sisy2020]

Thanks for following up!

I also have a few other advisory PRs in a similar situation where the upstream issue was fixed or acknowledged, but there has been no response to the RustSec question for over a month: #2969, #2977, #2997 and #3017.

For cases like these, would you prefer that I continue waiting for upstream responses, or is there a point where it makes sense to proceed or close the advisory PRs without further confirmation?

Thanks for the guidance!

[djc]

#2969, #2977, #2997 and #3017.

You should always feel free to ping me after 2 weeks of inactivity -- please do so on each PR, which makes it easier for me to keep track of things via my notifications queue.

Thanks for your patience and asking about the best way to move forward, much appreciated!

[sisy2020]

Thanks for the guidance! I'll ping each PR individually after two weeks of inactivity going forward.