Audit libflate #1

Activity

1. Shnatsel commented on Jul 21, 2019

   

   Shnatsel

   on Jul 21, 2019

   MemberAuthor

   More actions

   I've done the audit. Issues discovered:
   sile/libflate#29
   sile/libflate#31
   sile/libflate#33
   sile/libflate#35

   I've also fixed the code and dropped unsafe blocks where possible:
   sile/libflate#30
   sile/libflate#32
   sile/libflate#34
   sile/libflate#36
   sile/libflate#37
   sile/libflate#38

   🎉React with 🎉2Reacted by Phil Hansch and Jean Mertz
2. Shnatsel commented on Jul 21, 2019

   

   Shnatsel

   on Jul 21, 2019

   MemberAuthor

   More actions

   Unsafe blocks that could not be removed without regressing performance are blocked by:

   1. Reading a CString safely without overhead from Read rust-lang/rust#59229 for reading a CString from a stream without checking all bytes for zeroes twice
   2. RFC for Vec::append_from_within() rust-lang/rfcs#2714 for efficiently appending contents of a vector to itself
3. Shnatsel commented on Jul 21, 2019

   

   Shnatsel

   on Jul 21, 2019

   MemberAuthor

   More actions

   Security advisories:

   https://rustsec.org/advisories/RUSTSEC-2019-0010.html

   and we still need to figure out if sile/libflate#33 is exploitable or not. Once that's done this issue can be closed (and the blockers moved to some kind of central tracker, I guess markdown files in this repo?)
4. Shnatsel commented on Aug 31, 2019

   

   Shnatsel

   on Aug 31, 2019

   MemberAuthor

   More actions

   Exploitability analysis done, the flaw is found to be not exploitable. We're done!
5. Shnatsel

   closed this as completedon Aug 31, 2019
6. mleonhard commented on Mar 25, 2022

   

   mleonhard

   on Mar 25, 2022

   More actions

   sile/libflate#67 adds forbid(unsafe_code) 🎉

   🎉React with 🎉2Reacted by Sergey "Shnatsel" Davidoff and 8573
7. 8573

   added a commit that references this issue on Mar 25, 2022

   Update README re rust-secure-code#1

   ...

   8bb5450
8. Shnatsel

   added a commit that references this issue on Mar 25, 2022

   Merge pull request #77 from 8573/patch-1

   ...

   096daa4