GHSA-5gmm-6m36-r7jh

Source

https://github.com/advisories/GHSA-5gmm-6m36-r7jh

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/04/GHSA-5gmm-6m36-r7jh/GHSA-5gmm-6m36-r7jh.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-5gmm-6m36-r7jh

Aliases

Published

2024-04-05T15:41:34Z

Modified

2025-07-28T16:42:04.676549Z

Severity

4.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L CVSS Calculator

Summary

transpose: Buffer overflow due to integer overflow

Details

Given the function transpose::transpose:

fn transpose&lt;T: Copy>(input: &[T], output: &mut [T], input_width: usize, input_height: usize)

The safety check input_width * input_height == output.len() can fail due to input_width * input_height overflowing in such a way that it equals output.len(). As a result of failing the safety check, memory past the end of output is written to. This only occurs in release mode since * panics on overflow in debug mode.

Exploiting this issue requires the caller to pass input_width and input_height arguments such that multiplying them overflows, and the overflown result equals the lengths of input and output slices.

Database specific

{
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-120",
        "CWE-190"
    ],
    "nvd_published_at": null,
    "severity": "MODERATE",
    "github_reviewed_at": "2024-04-05T15:41:34Z"
}

References

Affected packages

crates.io / transpose

Package

Name: transpose; View open source insights on deps.dev
Purl: pkg:cargo/transpose

Affected ranges

Type: SEMVER
Events: Introduced

0.1.0

Fixed

0.2.3