RUSTSEC-2024-0443

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2024-0443

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2024-0443.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2024-0443

Aliases

GHSA-9q78-27f3-2jmh

Published

2024-09-06T12:00:00Z

Modified

2025-10-28T06:29:24.148191Z

Summary

webp crate may expose memory contents when encoding an image

Details

Affected versions of this crate did not check that the input slice passed to "webp::Encoder::encode() is large enough for the specified image dimensions.

If the input slice is too short, the library will read out of bounds of the buffer and encode other memory contents as an image, resulting in memory exposure or a segmentation fault.

The flaw was corrected in pull request #44 by always validating the input buffer size when constructing the encoder.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / webp

Package

Name: webp; View open source insights on deps.dev
Purl: pkg:cargo/webp

Affected ranges

Type: SEMVER
Events: Introduced

0.0.0-0

Fixed

0.3.1

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "arch": [],
        "functions": [],
        "os": []
    }
}