ntru-rs has unsound FFI: Wrong API usage causes write past allocated area
Moderate severity
GitHub Reviewed
Published
Apr 7, 2023
to the GitHub Advisory Database
•
Updated Apr 7, 2023
Description
Published to the GitHub Advisory Database
Apr 7, 2023
Reviewed
Apr 7, 2023
Last updated
Apr 7, 2023
The following usage causes undefined behavior.
When compiled with debug assertions, the code above will trigger a
attempt to subtract with overflow
panic before UB occurs.Other mistakes (e.g. using
EncParams
from a different key) may always trigger UB.Likely, older versions of this crate are also affected, but have not been tested.
References