From 61eeb789735d0c53c929bc87c8392659e7547815 Mon Sep 17 00:00:00 2001 From: MJUCOM Date: Tue, 4 Aug 2026 16:31:10 +0900 Subject: [PATCH] Add advisory for aarty --- crates/aarty/RUSTSEC-0000-0000.md | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) create mode 100644 crates/aarty/RUSTSEC-0000-0000.md diff --git a/crates/aarty/RUSTSEC-0000-0000.md b/crates/aarty/RUSTSEC-0000-0000.md new file mode 100644 index 0000000000..c420232c0f --- /dev/null +++ b/crates/aarty/RUSTSEC-0000-0000.md @@ -0,0 +1,30 @@ +```toml +[advisory] +id = "RUSTSEC-0000-0000" +package = "aarty" +date = "2024-10-13" +url = "https://github.com/0x61nas/aarty/issues/78" +informational = "unsound" +categories = ["memory-corruption"] +keywords = ["out-of-bounds", "heap-buffer-overflow", "unsafe", "unchecked-indexing"] + +[affected.functions] +"aarty::text_image::TextImage::get_unchecked" = ["<= 0.8.2"] + +[versions] +patched = [] +``` + +# `TextImage::get_unchecked` can access memory out of bounds if misused + +Affected versions of `aarty` expose `TextImage::get_unchecked` as a public +unsafe API. The function indexes into the internal `fragments` buffer without +performing bounds checks. + +Calling this function with an index outside the bounds of the image can cause +out-of-bounds memory access and undefined behavior. The issue was reported with +AddressSanitizer as an illegal instruction after unchecked indexing. + +The upstream maintainer has stated that `get_unchecked` is intentionally marked +unsafe and is expected to be used only when the caller can uphold the required +bounds invariant. No patched release is currently known.