| { |
| "item_id": "ker-transpose_dims", |
| "kernel": "transpose_dims", |
| "advisory": "RUSTSEC-2023-0080", |
| "crate": "transpose", |
| "pre_version": "0.2.2", |
| "post_version": "0.2.3", |
| "advisory_url": "https://github.com/ejmahler/transpose/issues/11", |
| "title": "Buffer overflow due to integer overflow in `transpose`", |
| "source_file": "src/lib.rs", |
| "function": "dims_match", |
| "signature": "pub fn dims_match(width: usize, height: usize, len: usize) -> bool", |
| "spec_doc": "True iff width * height == len in exact arithmetic (false when the product does not fit usize).", |
| "bug_class": "overflow", |
| "fidelity": "verbatim_logic", |
| "extraction_note": "src/lib.rs transpose: assert_eq!(w*h, len) wraps in release -> buffer overflow", |
| "witness_args": "4294967296usize, 4294967296usize, 0usize", |
| "labels": { |
| "buggy": "transpose@0.2.2", |
| "reference": "transpose@0.2.3" |
| } |
| } |
