Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add unsound mozjpeg #1389

Merged
merged 6 commits into from
Aug 30, 2022
Merged

Add unsound mozjpeg #1389

merged 6 commits into from
Aug 30, 2022

Conversation

pinkforest
Copy link
Contributor

@pinkforest pinkforest commented Aug 27, 2022

Closes #327

ImageOptim/mozjpeg-rust#10

@HeroicKatora would you mind reviewing this ? thx

Signed-off-by: pinkforest <[email protected]>
@pinkforest pinkforest added Unsound Informational / Unsound Propose-Merge Propose-Merge labels Aug 27, 2022
Copy link
Contributor

@HeroicKatora HeroicKatora left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Factually looks good. Style nit: The text refers to an explanation from RUSTSEC-2020-0029 but there's no link to it, I don't know how this is usually handled. As an alternative, the explanation could be inlined. Suggestion:

Affected versions of mozjpeg crate allow creating instances of any type T from bytes,
and do not correctly constrain T to the types for which it is safe to do so.
Examples of safety violation possible for a type T:

  • T contains a reference type, and it constructs a pointer to an invalid, arbitrary memory address.
  • T requires a safety and/or validity invariant for its construction that may be violated.

@pinkforest
Copy link
Contributor Author

pinkforest commented Aug 27, 2022

Thanks - we use references = ["url", ..] for this but added the inlined suggestion thanks!

EDIT: Also added link in the .md

EDIT.2: Also added function signature

Signed-off-by: pinkforest <[email protected]>
Signed-off-by: pinkforest <[email protected]>
Signed-off-by: pinkforest <[email protected]>
@pinkforest pinkforest merged commit cc892a6 into rustsec:main Aug 30, 2022
@pinkforest pinkforest deleted the add/unsound/mozjpeg branch August 30, 2022 18:35
@pinkforest pinkforest removed the Propose-Merge Propose-Merge label Aug 30, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Unsound Informational / Unsound
Projects
None yet
Development

Successfully merging this pull request may close these issues.

File advisories for vulnerabilities with upcoming fixes
2 participants