Skip to content

fast-float2 has a segmentation fault due to lack of bound check

Moderate severity GitHub Reviewed Published Jan 29, 2025 to the GitHub Advisory Database • Updated Jan 29, 2025

Package

cargo fast-float2 (Rust)

Affected versions

< 0.2.2

Patched versions

0.2.2

Description

In this case, the "fast_float2::common::AsciiStr::first" method within the "AsciiStr" struct
uses the unsafe keyword to reading from memory without performing bounds checking.
Specifically, it directly dereferences a pointer offset by "self.ptr".
Because of the above reason, the method accesses invalid memory address when it takes an empty string as its input.
This approach violates Rust’s memory safety guarantees, as it can lead to invalid memory access if empty buffer is provided.

References

Published to the GitHub Advisory Database Jan 29, 2025
Reviewed Jan 29, 2025
Last updated Jan 29, 2025

Severity

Moderate

EPSS score

Weaknesses

No CWEs

CVE ID

No known CVE

GHSA ID

GHSA-jqcp-xc3v-f446
Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.