PT-2024-40972 · Glib · Glib
Published
2024-03-30
·
Updated
2024-03-30
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
Name of the Vulnerable Software and Affected Versions
glib versions 0.15.0 and later
Description
The issue arises from the
VariantStrIter::impl get function, which was unsound and resulted in undefined behavior. This function, called internally by implementations of the Iterator and DoubleEndedIterator traits, passed an immutable reference to a mutable pointer to a C function, causing the pointer to be mutated in-place. Recent changes in the Rust compiler led to these unsound writes being disregarded when building the glib crate with optimizations, resulting in crashes due to NULL pointer dereferences. The problem occurred because the std::ffi::CStr::from ptr function requires a valid pointer to a C-style string, which was not provided.Recommendations
For glib versions 0.15.0 and later, the issue was fixed by passing the out-argument pointer explicitly as
&mut p instead of &p. As a temporary workaround, consider restricting the use of the VariantStrIter::impl get function until the fix is applied. Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Glib