/
DirectorySecurity Advisories
Sign In
Security Advisories

CGA-q4hr-6pr9-jvmw

Published

Last updated

https://images.chainguard.dev/security/CGA-q4hr-6pr9-jvmw
Package

pgcat

Latest Update
Fixed
Fixed Version

1.2.0-r2

Aliases
  • GHSA-2rxc-gjrp-vjhx

Summary

Unsoundness in anstream

Description

When given a valid UTF8 string "ö\x1b😀", the function in crates/anstream/src/adapter/strip.rs will be confused. The UTF8 bytes are \xc3\xb6 then \x1b then \xf0\x9f\x98\x80.

When looping over "non-printable bytes" \x1b\xf0 will be considered as some non-printable sequence.

This will produce a broken str from the incorrectly segmented bytes via str::from_utf8_unchecked, and that should never happen.

Full credit goes to @Ralith who reviewed this code and asked @burakemir to follow up.

References

Updates


Safe Source for Open Sourceâ„¢
Media KitContact Us
© 2024 Chainguard. All Rights Reserved.
Private PolicyTerms of Use

Product

Chainguard Images