From 83cc52bc4b7519c079d3debeeff4b9effcaebdb9 Mon Sep 17 00:00:00 2001 From: lwz23 Date: Mon, 11 Nov 2024 05:02:09 -0500 Subject: [PATCH 1/3] Add vulnerability advisory for n2 --- crates/n2/RUSTSEC-2024-0397.md | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) create mode 100644 crates/n2/RUSTSEC-2024-0397.md diff --git a/crates/n2/RUSTSEC-2024-0397.md b/crates/n2/RUSTSEC-2024-0397.md new file mode 100644 index 0000000000..113afa6a7d --- /dev/null +++ b/crates/n2/RUSTSEC-2024-0397.md @@ -0,0 +1,24 @@ +# Advisory for n2 +```toml +[advisory] +id = "RUSTSEC-2024-0397" +package = "n2" +date = "2024-11-11" +informational = "unsound" +url = "https://github.com/evmar/n2/issues/121" +references = ["https://github.com/evmar/n2/issues/122", "https://github.com/evmar/n2/issues/123"] +aliases = [] + +[versions] +patched = [] +``` + +# Multiple soundness issues + +`n2` contains multiple soundness issues: + +n2 contains multiple soundness issues: + +1. Invalid Input Handling in Scanner::slice Method. When using the Scanner::slice method, passing an out-of-bounds argument causes the program to panic abort. This indicates a potential design flaw, as it fails to handle invalid input properly, impacting the stability of the application. [Issue #121](https://github.com/evmar/n2/issues/121) +2. Out of Bounds Access in Scanner::peek Method. The peek method in the Scanner struct does not handle out-of-bounds accesses correctly. When the internal offset exceeds the length of the buffer, it causes a panic abort. [Issue #122](https://github.com/evmar/n2/issues/122) +3. Invalid Input Handling in Scanner::peek_newline Method. The peek_newline method fails to handle cases where the internal offset exceeds the size of the buffer, leading to a panic abort. This indicates a design flaw as invalid input is not handled properly. [Issue #123](https://github.com/evmar/n2/issues/123) From 9aadcc9fd0e61c497cf85f99fd13be065cebd9fd Mon Sep 17 00:00:00 2001 From: lwz23 Date: Mon, 11 Nov 2024 05:16:55 -0500 Subject: [PATCH 2/3] fix PR lint check error --- crates/n2/RUSTSEC-2024-0397.md | 1 - 1 file changed, 1 deletion(-) diff --git a/crates/n2/RUSTSEC-2024-0397.md b/crates/n2/RUSTSEC-2024-0397.md index 113afa6a7d..f1fa31e169 100644 --- a/crates/n2/RUSTSEC-2024-0397.md +++ b/crates/n2/RUSTSEC-2024-0397.md @@ -1,4 +1,3 @@ -# Advisory for n2 ```toml [advisory] id = "RUSTSEC-2024-0397" From fc7410dee5e14a1dee1e9ef3782ce2e1f3f6b20a Mon Sep 17 00:00:00 2001 From: lwz23 Date: Mon, 11 Nov 2024 05:20:50 -0500 Subject: [PATCH 3/3] fix duplicate advisory ID --- crates/n2/{RUSTSEC-2024-0397.md => RUSTSEC-2024-0411.md} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename crates/n2/{RUSTSEC-2024-0397.md => RUSTSEC-2024-0411.md} (98%) diff --git a/crates/n2/RUSTSEC-2024-0397.md b/crates/n2/RUSTSEC-2024-0411.md similarity index 98% rename from crates/n2/RUSTSEC-2024-0397.md rename to crates/n2/RUSTSEC-2024-0411.md index f1fa31e169..e89477aa6d 100644 --- a/crates/n2/RUSTSEC-2024-0397.md +++ b/crates/n2/RUSTSEC-2024-0411.md @@ -1,6 +1,6 @@ ```toml [advisory] -id = "RUSTSEC-2024-0397" +id = "RUSTSEC-2024-0411" package = "n2" date = "2024-11-11" informational = "unsound"