[GHSA-mrrw-grhq-86gf] Ascii (crate) allows out-of-bounds array indexing in safe code

[RainSignal]

Updates

• Affected products
• CWEs

Comments

1. Affected versions corrected

The advisory states affected versions start from 0.6.0, but code
review shows this is incorrect.

Version 0.6.0 was verified to NOT contain the vulnerable code:
https://github.com/tomprogrammer/rust-ascii/blob/0.6.0/src/lib.rs

The file only contains immutable AsRef trait implementations, with
no impl_into! macro and no mutable From implementations.

Version 0.7.0 was verified to contain the vulnerable code:
https://github.com/tomprogrammer/rust-ascii/blob/v0.7.0/src/ascii_str.rs

The impl_into! macro in 0.7.0 generates both of the unsound
implementations:

• impl From<&mut AsciiStr> for &mut [u8]
• impl From<&mut AsciiStr> for &mut str

Therefore the affected version range should start from 0.7.0,
not 0.6.0.

2. Weakness corrected

The current advisory has no CWE assigned. The correct weakness is
CWE-119 (Improper Restriction of Operations within the Bounds of a
Memory Buffer), as the unsound mutable From implementations allow
writing non-ASCII bytes into an AsciiStr, which when later read as
AsciiChar produces values outside the valid niche, causing
out-of-bounds array indexing in safe code.

[github-actions]

👋 This pull request has been marked as stale because it has been open with no activity. You can: comment on the issue or remove the stale label to hold stale off for a while, add the Keep label to hold stale off permanently, or do nothing. If you do nothing this pull request will be closed eventually by the stale bot. Please see CONTRIBUTING.md for more policy details.

[advisory-database]

Hi @RainSignal! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future!