Fix incomplete affected functions for RUSTSEC-2026-0041#2724
Fix incomplete affected functions for RUSTSEC-2026-0041#2724Marcono1234 wants to merge 1 commit intorustsec:mainfrom
Conversation
| - Decompressing with the `unsafe` implementation (`safe-decode` feature flag disabled, which | ||
| is the default): can leak content of uninitialized memory as part of the decompressed result. | ||
| - Decompressing with the `unsafe` implementation (`safe-decode` feature flag disabled; flag is | ||
| enabled by default): can leak content of uninitialized memory as part of the decompressed result. |
There was a problem hiding this comment.
Reworded this to make it (hopefully) clearer; "which is the default" might have been ambiguous, e.g. whether it means "the flag is enabled by default" or "the flag being disabled is the default".
I hope that is ok.
| "lz4_flex::block::decompress" = ["<= 0.11.5", "= 0.12.0"] | ||
| "lz4_flex::block::decompress_with_dict" = ["<= 0.11.5", "= 0.12.0"] | ||
| "lz4_flex::block::decompress_size_prepended" = ["<= 0.11.5", "= 0.12.0"] | ||
| "lz4_flex::block::decompress_size_prepended_with_dict" = ["<= 0.11.5", "= 0.12.0"] | ||
| # Deprecated re-exports | ||
| "lz4_flex::decompress" = ["<= 0.11.5", "= 0.12.0"] | ||
| "lz4_flex::decompress_into" = ["<= 0.11.5", "= 0.12.0"] | ||
| "lz4_flex::decompress_size_prepended" = ["<= 0.11.5", "= 0.12.0"] |
There was a problem hiding this comment.
I hope I did not overlook something here. If possible please double-check.
I don't know how various tools consume this information. |
2 participants
See also PSeitz/lz4_flex#213 (comment)
CC @PSeitz
(Question to the rustsec maintainers mostly) What exact effect does
affected.functionshave though, and can it cause false negatives? E.g. when someone uses an ancient lz4_flex version (quite unlikely though) where the API was different, would that be erroneously be considered safe? Maybe the implementation back then was actually not affected by this vulnerability, though might be better to err on the safe side and flag usage of such old versions as vulnerable?