scanner-rs OOB read

[charlesxsh]

No description provided.

[djc]

It's not obvious how this crate is implicated. Have you filed an issue against it? Does the maintainer agree that there is an issue that warrants an advisory? Has a fix been released?

[charlesxsh]

It's not obvious how this crate is implicated. Have you filed an issue against it? Does the maintainer agree that there is an issue that warrants an advisory? Has a fix been released?

Actually I would like to create issue over there at first. However, that git repository does not allow me to create an issue.

[charlesxsh]

The code snippet is copied from the crate's lib.rs

https://github.com/pombredanne/scanner-rs/blob/2893e45f8d60692a11e8584ba01eb38fe7798fea/src/lib.rs#L398C1-L420C2

[tarcieri]

You can create a new issue here: https://github.com/pombredanne/scanner-rs/issues/new

Edit: weird, 404 on desktop, works on mobile but I can't actually post an issue

Looks like you might be able to open a PR?

[djc]

Submitting a PR (maybe adding an unmaintained notice to the README) seems like a decent way to notify the author. The repo has just 1 commit from 9 years ago so I wouldn't expect a lot of activity, but at least the author still seems quite active on GitHub.

[charlesxsh]

Submitting a PR (maybe adding an unmaintained notice to the README) seems like a decent way to notify the author. The repo has just 1 commit from 9 years ago so I wouldn't expect a lot of activity, but at least the author still seems quite active on GitHub.

I created a PR pombredanne/scanner-rs#1

[djc]

Sent an email to the maintainer to notify them of this advisory. Per discussion in #1092, will merge if there's been no response in 2 weeks.

[pombredanne]

FYI: pombredanne/scanner-rs#1 (comment)
repasting here for reference:

I am not the maintainer of this as explained to @djc in a private email.
I am fine to merge this based on external reviewer inputs. I can transfer this repo to someone in the Rust community if you think this is useful and used.

The funny thing is that this NOT my crate. I just happen to be the last remaining fork, but my fork was passive.

Digging a bit, this used to be there from @CasualX :

https://archive.softwareheritage.org/browse/origin/directory/?origin_url=https://github.com/CasualX/scanner-rs

[pombredanne]

Sent an email to the maintainer to notify them of this advisory. Per discussion in #1092, will merge if there's been no response in 2 weeks.

@djc please go ahead and merge. I merged @charlesxsh patch. I assume this code is correct. I would welcome a second pair of eyes on

• https://github.com/pombredanne/scanner-rs/pull/1/files

If problematic, I will revert and update as needed.

[pombredanne]

@tarcieri re:

Edit: weird, 404 on desktop, works on mobile but I can't actually post an issue
Looks like you might be able to open a PR?

This happened as this was not the head repo. When you fork in GH, issues are not enabled by default. Only PRs. I fixed this.

[pombredanne]

Note also that I do NOT own the record at https://crates.io/crates/scanner .... this is @CasualX so I cannot do much of anything to push updated releases.

[djc]

@pombredanne thanks for the quick response, sorry for bothering you -- should have checked the metadata more carefully.

[djc]

Could not find an email address for @CasualX, so let's wait to see if they respond here? @CasualX -- please let us know if you're okay with us publishing an advisory for your old crate.

[CasualX]

Oh hi, I was a bit concerned to see this but yeah this is very old code. This project has been folded into my pelite crate, you can find the relevant code here which should not be vulnerable (the API was entirely reworked).

I don't mind if this scanner-rs crate is deleted in its entirety, anyone still using it should update to pelite proper.

Thanks for the ping!

[djc]

@CasualX thanks!

@charlesxsh can you rewrite this advisory as explained previously?

[charlesxsh]

@djc updated it

[djc]

Thanks!

[pombredanne]

Great conclusion. 🙇