522

File write vulnerability if username contains `../`

4

I set my username on client A to `../../home/jess/.ssh` and used `?send authorized_keys`. This then wrote the contents of `authorized_keys` to the actual authorized_keys on the target machine. I haven't...

Stacked borrows miri failure in `test_map_axis`

1

Running `MIRIFLAGS="-Zmiri-tag-raw-pointers" cargo miri test test_map_axis` yields this stack trace ```rust test test_map_axis ... error: Undefined Behavior: trying to reborrow for SharedReadOnly at alloc186627+0xc, but parent tag does not have...

Found through fuzzing and minimized the test case manually. Sample program (Tested against 0.8.3 on crates.io as well as the latest version from git (df46cd4)) ```rust fn main() { let...

Publish new release?

1

Hello! I'm coming to this project from https://github.com/rust-lang/rust/pull/99389 , where some stricter checks of creation of uninitialized data is being tested out, and the crates.io version of this crate ran...

Reproduction code: ```rust use pgp::de::Deserialize; fn main() { let data = [5, 2, 2, 11, 0, 2, 0, 0]; let _ = pgp::Signature::from_slice(pgp::types::Version::New, &data); } ``` Error: ```rust thread 'main'...

Have subcommand for running multiple/all fuzz targets, one at a time

3

This comes from the https://github.com/rust-fuzz/targets crate, which has a CLI to make running `cargo-fuzz` on many different targets easier. Maybe `cargo fuzz autorun` to run *all* targets, and `cargo fuzz...

The following code prints an arbitrary number, because the vec has already been dropped. I can also get aliasing &mut's to the same value by simply calling p.longs() multiple times,...

Extremely slow demangling of malformed symbol using excessive memory

2

Test case: ```rust fn main() { symbolic::demangle::demangle("_ZUlzjjlZZL1zStUlSt7j_Z3kjIIjIjL1vfIIEEEjzjjfjzSt7j_Z3kjIIjfjzL4t3kjIIjfjtUlSt7j_Z3kjIIjIjL1vfIIEEEjzjjfjzSt7j_Z3kjIIjfjzL4t3kjIIjfjzL4t7IjIjjzjjzSt7j_Z3kjIIjfjzStfjzSt7j_ZA3kjIIjIjL1vfIIEEEjzjjfjzSt7j_Z3kjIIjIjL1vfIIEEEjzjjfjzSt7j_Z3kjIIjfjzL4t3kjIIjzL4t7IjIjjzjjzSt7j_Z3kjIIjfjzStfjzSt7j_ZA3kjIIjIjL1vfIIEEEjzjjfjzSt7j_Z3kjIIjIjL1vfIIEEEjzjjfjzSt7j_Z3kjIIjfjzL4t3kjIIjfjzL4t7IjIjL1vfIIEEEjzjjSI"); } ``` This is *probably* a cpp_demangle issue, but I can't reproduce this there. At least, that's where the stack trace led. When...

Are overlong `VarUInt` mandatory to support or mandatory to forbid?

1

Is it legal to encode `1` as `0x81, 0x80, 0x80, 0x00`? Nothing in the spec *forbids* it, but it's just not mentioned. The example code would decode that just fine....

path_ignore_case fails with a non-ASCII first character

1

test case: ```rust #[test] fn test_non_ascii() { let mut tree = Node::new(); tree.insert("x:x", ()); tree.path_ignore_case("£", false); } ```