From 6e1db237036b19b329141bb68970557f593d1918 Mon Sep 17 00:00:00 2001 From: Safe4U Date: Sun, 7 Jul 2024 16:39:38 +0800 Subject: [PATCH] Add advisory for substreams --- crates/substreams/RUSTSEC-0000-0000.md | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) create mode 100644 crates/substreams/RUSTSEC-0000-0000.md diff --git a/crates/substreams/RUSTSEC-0000-0000.md b/crates/substreams/RUSTSEC-0000-0000.md new file mode 100644 index 000000000..cb05c51b8 --- /dev/null +++ b/crates/substreams/RUSTSEC-0000-0000.md @@ -0,0 +1,26 @@ +```toml +[advisory] +id = "RUSTSEC-0000-0000" +package = "substreams" +date = "2024-07-07" +url = "https://github.com/streamingfast/substreams-rs/issues/24" +informational = "unsound" +categories = ["memory-exposure"] + +[affected.functions] +"substreams::memory::get_output_data" = ["<= 0.5.20"] +"substreams::memory::read_u32_from_heap" = ["<= 0.5.20"] +"substreams::proto::decode_ptr" = ["<= 0.5.20"] + +[versions] +patched = [] +``` + +# Unsoundly mark unsafe functions as safe + +The functions `read_u32_from_heap`, `get_output_data`, and `decode_ptr` in crate +`substreams` are unsafe since they directly operate on the pointer passed in and +have requirements for the caller. + +These functions allow the caller to access memory illegally and generate undefined +`Vec` which could lead to more undefined behaviors.