| { |
| "item_id": "ker-versionize_fam", |
| "kernel": "versionize_fam", |
| "advisory": "RUSTSEC-2023-0030", |
| "crate": "versionize", |
| "pre_version": "0.1.9", |
| "post_version": "0.1.10", |
| "advisory_url": "https://github.com/firecracker-microvm/versionize/pull/53", |
| "title": "`Versionize::deserialize` implementation for `FamStructWrapper<T>` is lacking bound checks, potentially leading to out of bounds memory accesses ", |
| "source_file": "src/primitives.rs", |
| "function": "fam_entry", |
| "signature": "pub fn fam_entry(entries: &[u32], header_len: usize, i: usize) -> Result<u32, u8>", |
| "spec_doc": "Reads entry i (< header_len) of a deserialised flexible-array struct whose header declares header_len entries; Err if the header length disagrees with the actual number of entries, never panic.", |
| "bug_class": "panic", |
| "fidelity": "model_of_std", |
| "extraction_note": "src/primitives.rs FamStructWrapper::deserialize: header length not checked against entries", |
| "witness_args": "&[7u32, 8], 5usize, 3usize", |
| "labels": { |
| "buggy": "versionize@0.1.9", |
| "reference": "versionize@0.1.10" |
| } |
| } |
