Skip to content

Commit

Permalink
Add advisory for temporary
Browse files Browse the repository at this point in the history
  • Loading branch information
5225225 committed Aug 8, 2022
1 parent 9738835 commit 8a08e68
Showing 1 changed file with 32 additions and 0 deletions.
32 changes: 32 additions & 0 deletions crates/temporary/RUSTSEC-0000-0000.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,32 @@
```toml
[advisory]
id = "RUSTSEC-0000-0000"
package = "temporary"
date = "2018-08-22"
url = "https://github.com/stainless-steel/temporary/issues/2"
categories = ["memory-exposure"]
keywords = ["uninitialized-memory"]

[versions]
patched = [">= 0.6.4"]
unaffected = ["< 0.3.0"]
```

# Use of uninitialized memory in temporary

Uninit memory is used as a RNG seed in temporary

The following function is used as a way to get entropy from the system, which does operations on and exposes uninit memory, which is UB.

```rust
fn random_seed(_: &Path, _: &str) -> [u64; 2] {
use std::mem::uninitialized as rand;
unsafe { [rand::<u64>() ^ 0x12345678, rand::<u64>() ^ 0x87654321] }
}
```

This has been resolved in the 0.6.4 release.

The crate is not intended to be used outside of a testing environment.

For a general purpose crate to create temporary directories, `tempfile` is an alternative for this crate.

0 comments on commit 8a08e68

Please sign in to comment.