{"id":"GHSA-q579-9wp9-gfp2","summary":"Window can read out of bounds if Read instance returns more bytes than buffer size","details":"`rdiff` performs a diff of two provided strings or files. As part of its reading code it uses the return value of a `Read` instance to set the length of its internal character vector.\n\nIf the `Read` implementation claims that it has read more bytes than the length of the provided buffer, the length of the vector will be set to longer than its capacity. This causes `rdiff` APIs to return uninitialized memory in its API\nmethods.\n","aliases":["CVE-2021-45694","GHSA-2rxc-8f9w-fjq8","RUSTSEC-2021-0094"],"modified":"2023-11-08T04:07:22.314410Z","published":"2022-06-17T00:14:18Z","database_specific":{"nvd_published_at":null,"cwe_ids":[],"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2022-06-17T00:14:18Z"},"references":[{"type":"WEB","url":"https://github.com/dyule/rdiff/issues/3"},{"type":"PACKAGE","url":"https://github.com/dyule/rdiff"},{"type":"WEB","url":"https://rustsec.org/advisories/RUSTSEC-2021-0094.html"}],"affected":[{"package":{"name":"rdiff","ecosystem":"crates.io","purl":"pkg:cargo/rdiff"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"0.1.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/06/GHSA-q579-9wp9-gfp2/GHSA-q579-9wp9-gfp2.json"}}],"schema_version":"1.9.0"}