pancurses icon indicating copy to clipboard operation
pancurses copied to clipboard

panic of unwrap() on CString creation

Open alexanderkjall opened this issue 4 years ago • 0 comments

Hi

I did some fuzzing of display of untrusted strings in cursive that uses this library and found this crash:

thread '<unnamed>' panicked at 'called `Result::unwrap()` on an `Err` value: NulError(0, [0])', /home/capitol/.cargo/registry/src/github.com-1ecc6299db9ec823/pancurses-0.16.1/src/window.rs:392:47

It seems to be because the library uses this construct CString::new(string.as_ref()).unwrap(); which fails on some strings, for example a string created like this:

let null : Vec<u8> = vec![0];
let null_str = str::from_utf8(&null).unwrap();

As far as I can find there is 8 different cases of this pattern.

alexanderkjall avatar Aug 19 '20 09:08 alexanderkjall