File tree Expand file tree Collapse file tree 1 file changed +32
-0
lines changed Expand file tree Collapse file tree 1 file changed +32
-0
lines changed Original file line number Diff line number Diff line change 1+ ``` toml
2+ [advisory ]
3+ id = " RUSTSEC-0000-0000"
4+ package = " temporary"
5+ date = " 2018-08-22"
6+ url = " https://github.com/stainless-steel/temporary/issues/2"
7+ categories = [" memory-exposure" ]
8+ keywords = [" uninitialized-memory" ]
9+
10+ [versions ]
11+ patched = [" >= 0.6.4" ]
12+ unaffected = [" < 0.3.0" ]
13+ ```
14+
15+ # Use of uninitialized memory in temporary
16+
17+ Uninit memory is used as a RNG seed in temporary
18+
19+ The following function is used as a way to get entropy from the system, which does operations on and exposes uninit memory, which is UB.
20+
21+ ``` rust
22+ fn random_seed (_ : & Path , _ : & str ) -> [u64 ; 2 ] {
23+ use std :: mem :: uninitialized as rand;
24+ unsafe { [rand :: <u64 >() ^ 0x12345678 , rand :: <u64 >() ^ 0x87654321 ] }
25+ }
26+ ```
27+
28+ This has been resolved in the 0.6.4 release.
29+
30+ The crate is not intended to be used outside of a testing environment.
31+
32+ For a general purpose crate to create temporary directories, [ ` tempfile ` ] ( https://crates.io/crates/tempfile ) is an alternative for this crate.
You can’t perform that action at this time.
0 commit comments