GHSA-66fw-43h8-f8p3
Suggest an improvement- Source
- https://github.com/advisories/GHSA-66fw-43h8-f8p3
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/07/GHSA-66fw-43h8-f8p3/GHSA-66fw-43h8-f8p3.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-66fw-43h8-f8p3
- Published
- 2024-07-26T21:14:54Z
- Modified
- 2024-07-26T21:14:54Z
- Summary
- XMP Toolkit's `XmpFile::close` can trigger undefined behavior
- Details
-
Affected versions of the crate failed to catch C++ exceptions raised within the
XmpFile::closefunction. If such an exception occured, it would trigger undefined behavior, typically a process abort.This is best demonstrated in issue #230, where a race condition causes the
closecall to fail due to file I/O errors.This was fixed in PR #232 (released as crate version 1.9.0), which now safely handles the exception.
For backward compatibility, the existing API ignores the error. A new API
XmpFile::try_closewas added to allow callers to receive and process the error result.Users of all prior versions of
xmp_toolkitare encouraged to update to version 1.9.0 to avoid undefined behavior. - References
Affected packages
crates.io / xmp_toolkit
Package
- Name
- xmp_toolkit
- View open source insights on deps.dev
- Purl
- pkg:cargo/xmp_toolkit