Skip to content

Commit 362497a

Browse files
committed
Add advisory for temporary
1 parent 9738835 commit 362497a

File tree

1 file changed

+32
-0
lines changed

1 file changed

+32
-0
lines changed

crates/temporary/RUSTSEC-0000-0000.md

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
```toml
2+
[advisory]
3+
id = "RUSTSEC-0000-0000"
4+
package = "temporary"
5+
date = "2018-08-22"
6+
url = "https://github.com/stainless-steel/temporary/issues/2"
7+
categories = ["memory-exposure"]
8+
keywords = ["uninitialized-memory"]
9+
10+
[versions]
11+
patched = [">= 0.6.4"]
12+
unaffected = ["< 0.3.0"]
13+
```
14+
15+
# Use of uninitialized memory in temporary
16+
17+
Uninit memory is used as a RNG seed in temporary
18+
19+
The following function is used as a way to get entropy from the system, which does operations on and exposes uninit memory, which is UB.
20+
21+
```rust
22+
fn random_seed(_: &Path, _: &str) -> [u64; 2] {
23+
use std::mem::uninitialized as rand;
24+
unsafe { [rand::<u64>() ^ 0x12345678, rand::<u64>() ^ 0x87654321] }
25+
}
26+
```
27+
28+
This has been resolved in the 0.6.4 release.
29+
30+
The crate is not intended to be used outside of a testing environment.
31+
32+
For a general purpose crate to create temporary directories, [`tempfile`](https://crates.io/crates/tempfile) is an alternative for this crate.

0 commit comments

Comments
 (0)