{"id":"GHSA-qwgh-2vcv-g2f7","aliases":[],"status":"published","title":"block_buffer: panic corrupts inline buffer position","description":"### Summary\n\nA caught panic may leave the cursor position of `EagerBuffer` or `ReadBuffer` in a corrupted state; this in turn allows out-of-bounds reads/writes.\n\n### Details \u0026 PoC\n\nThe following two tests fail miri:\n\n```rust\n#[cfg(miri)]\n#[test]\nfn eager_digest_blocks_panic_corrupts_inline_position() {\n    // `EagerBuffer` stores its cursor in the last byte of the internal block.\n    // When `digest_blocks` completes a previously partial block, it overwrites\n    // that byte with input data before invoking the caller-provided `compress`\n    // callback. If the callback panics, safe code can catch the panic and keep\n    // using the buffer while its cursor byte no longer satisfies the internal\n    // `pos \u003c block_size` invariant. Under Miri this `get_pos` call reaches the\n    // `unreachable_unchecked` used for the assumed-valid cursor.\n    let mut buf = EagerBuffer::\u003cU4\u003e::new(\u0026[1, 2]);\n\n    let _ = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| {\n        buf.digest_blocks(\u0026[3, 0xff], |_| panic!(\"simulated compression failure\"));\n    }));\n\n    let _ = buf.get_pos();\n}\n\n#[cfg(miri)]\n#[test]\nfn read_buffer_generator_panic_corrupts_inline_position() {\n    // `ReadBuffer` stores its cursor in `buffer[0]`, but `write_block` gives\n    // `gen_block` mutable access to the whole internal block before restoring\n    // `buffer[0]` to a valid cursor. If `gen_block` writes an arbitrary first\n    // byte and panics, safe code can catch the panic and later observe an\n    // invalid cursor. Under Miri this `get_pos` call reaches the\n    // `unreachable_unchecked` used for the assumed-valid cursor.\n    let mut buf = ReadBuffer::\u003cU4\u003e::default();\n\n    let _ = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| {\n        buf.write_block(\n            1,\n            |block| {\n                block[0] = 0xff;\n                panic!(\"simulated block generation failure\");\n            },\n            |_| {},\n        );\n    }));\n\n    let _ = buf.get_pos();\n}\n```\n\nThey fail on an `unreachable_unchecked!()` under the invariant for the `pos` to always be within bounds of the block.\n\n### Impact\n\nWhile the byte that overwrites `pos` may come from untrusted input and is therefore attacker-controlled, this still relies on the surrounding code catching the panic and carrying on, which should be uncommon in practice.\n\nFor this to be exploitable, the attacker also needs a way to trigger a panic here; I have not investigated how feasible that is.\n\n### Credits\n\nThe issue was discovered by GPT-5.5","severity":{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2026-08-19T19:15:34Z","modified":"2026-10-30T15:45:11Z","fixes":[{"ecosystem":"crates.io","package":"block_buffer","fixed_in":["0.12.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"block_buffer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.11.0"},{"fixed":"0.12.1"}]}]},{"source":"osv","ecosystem":"crates.io","package":"block_buffer","ranges":[{"type":"SEMVER","events":[{"introduced":"0.11.0"},{"fixed":"0.12.1"}]}]}],"references":[{"url":"https://github.com/RustCrypto/utils/security/advisories/GHSA-qwgh-2vcv-g2f7","tags":["web"]},{"url":"https://github.com/RustCrypto/utils/releases/tag/block-buffer-v0.12.1","tags":["web"]},{"url":"https://github.com/advisories/GHSA-qwgh-2vcv-g2f7"},{"url":"https://github.com/RustCrypto/utils","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-qwgh-2vcv-g2f7","title":"block_buffer: panic corrupts inline buffer position","description":"### Summary\n\nA caught panic may leave the cursor position of `EagerBuffer` or `ReadBuffer` in a corrupted state; this in turn allows out-of-bounds reads/writes.\n\n### Details \u0026 PoC\n\nThe following two tests fail miri:\n\n```rust\n#[cfg(miri)]\n#[test]\nfn eager_digest_blocks_panic_corrupts_inline_position() {\n    // `EagerBuffer` stores its cursor in the last byte of the internal block.\n    // When `digest_blocks` completes a previously partial block, it overwrites\n    // that byte with input data before invoking the caller-provided `compress`\n    // callback. If the callback panics, safe code can catch the panic and keep\n    // using the buffer while its cursor byte no longer satisfies the internal\n    // `pos \u003c block_size` invariant. Under Miri this `get_pos` call reaches the\n    // `unreachable_unchecked` used for the assumed-valid cursor.\n    let mut buf = EagerBuffer::\u003cU4\u003e::new(\u0026[1, 2]);\n\n    let _ = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| {\n        buf.digest_blocks(\u0026[3, 0xff], |_| panic!(\"simulated compression failure\"));\n    }));\n\n    let _ = buf.get_pos();\n}\n\n#[cfg(miri)]\n#[test]\nfn read_buffer_generator_panic_corrupts_inline_position() {\n    // `ReadBuffer` stores its cursor in `buffer[0]`, but `write_block` gives\n    // `gen_block` mutable access to the whole internal block before restoring\n    // `buffer[0]` to a valid cursor. If `gen_block` writes an arbitrary first\n    // byte and panics, safe code can catch the panic and later observe an\n    // invalid cursor. Under Miri this `get_pos` call reaches the\n    // `unreachable_unchecked` used for the assumed-valid cursor.\n    let mut buf = ReadBuffer::\u003cU4\u003e::default();\n\n    let _ = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| {\n        buf.write_block(\n            1,\n            |block| {\n                block[0] = 0xff;\n                panic!(\"simulated block generation failure\");\n            },\n            |_| {},\n        );\n    }));\n\n    let _ = buf.get_pos();\n}\n```\n\nThey fail on an `unreachable_unchecked!()` under the invariant for the `pos` to always be within bounds of the block.\n\n### Impact\n\nWhile the byte that overwrites `pos` may come from untrusted input and is therefore attacker-controlled, this still relies on the surrounding code catching the panic and carrying on, which should be uncommon in practice.\n\nFor this to be exploitable, the attacker also needs a way to trigger a panic here; I have not investigated how feasible that is.\n\n### Credits\n\nThe issue was discovered by GPT-5.5","status":"published","published":"2026-08-19T19:15:34Z","modified":"2026-10-30T15:32:34Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:41:41.028239Z"}],"osv":[{"id":"GHSA-qwgh-2vcv-g2f7","title":"block_buffer: panic corrupts inline buffer position","description":"### Summary\n\nA caught panic may leave the cursor position of `EagerBuffer` or `ReadBuffer` in a corrupted state; this in turn allows out-of-bounds reads/writes.\n\n### Details \u0026 PoC\n\nThe following two tests fail miri:\n\n```rust\n#[cfg(miri)]\n#[test]\nfn eager_digest_blocks_panic_corrupts_inline_position() {\n    // `EagerBuffer` stores its cursor in the last byte of the internal block.\n    // When `digest_blocks` completes a previously partial block, it overwrites\n    // that byte with input data before invoking the caller-provided `compress`\n    // callback. If the callback panics, safe code can catch the panic and keep\n    // using the buffer while its cursor byte no longer satisfies the internal\n    // `pos \u003c block_size` invariant. Under Miri this `get_pos` call reaches the\n    // `unreachable_unchecked` used for the assumed-valid cursor.\n    let mut buf = EagerBuffer::\u003cU4\u003e::new(\u0026[1, 2]);\n\n    let _ = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| {\n        buf.digest_blocks(\u0026[3, 0xff], |_| panic!(\"simulated compression failure\"));\n    }));\n\n    let _ = buf.get_pos();\n}\n\n#[cfg(miri)]\n#[test]\nfn read_buffer_generator_panic_corrupts_inline_position() {\n    // `ReadBuffer` stores its cursor in `buffer[0]`, but `write_block` gives\n    // `gen_block` mutable access to the whole internal block before restoring\n    // `buffer[0]` to a valid cursor. If `gen_block` writes an arbitrary first\n    // byte and panics, safe code can catch the panic and later observe an\n    // invalid cursor. Under Miri this `get_pos` call reaches the\n    // `unreachable_unchecked` used for the assumed-valid cursor.\n    let mut buf = ReadBuffer::\u003cU4\u003e::default();\n\n    let _ = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| {\n        buf.write_block(\n            1,\n            |block| {\n                block[0] = 0xff;\n                panic!(\"simulated block generation failure\");\n            },\n            |_| {},\n        );\n    }));\n\n    let _ = buf.get_pos();\n}\n```\n\nThey fail on an `unreachable_unchecked!()` under the invariant for the `pos` to always be within bounds of the block.\n\n### Impact\n\nWhile the byte that overwrites `pos` may come from untrusted input and is therefore attacker-controlled, this still relies on the surrounding code catching the panic and carrying on, which should be uncommon in practice.\n\nFor this to be exploitable, the attacker also needs a way to trigger a panic here; I have not investigated how feasible that is.\n\n### Credits\n\nThe issue was discovered by GPT-5.5","status":"published","published":"2026-08-19T19:15:34Z","modified":"2026-10-30T15:45:11.580215361Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T15:46:55.122811Z"}]}}