{"id":"RUSTSEC-2024-0448","aliases":[],"status":"published","title":"`parse_arguments` reads a caller-supplied pointer as a slice","description":"`parse_arguments` is safe. It takes `arguments: *const AnyObject` and `argc`, and calls `slice::from_raw_parts(arguments, argc as usize)`.\n\nIt does not check that `arguments` is non-null and aligned, or that `argc` elements are initialized. Safe Rust can pass a null pointer or a length past the allocation. The maintainer confirmed this on 2026-10-03, including a debug abort on Rust 1.78+ when Ruby calls an arity -1 method (`to_s` via `format`, `puts`, or `Array#join`) with a NULL `argv` and `argc` of 0.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2024-11-25T12:00:00Z","modified":"2026-10-03T08:15:02Z","fixes":[{"ecosystem":"crates.io","package":"rutie","fixed_in":["0.10.3","0.11.3","0.12.1","0.13.1","0.14.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"crates.io","package":"rutie","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.10.3"},{"introduced":"0.11.0"},{"fixed":"0.11.3"},{"introduced":"0.12.0"},{"fixed":"0.12.1"},{"introduced":"0.13.0"},{"fixed":"0.13.1"},{"introduced":"0.14.0"},{"fixed":"0.14.1"}]}]}],"references":[{"url":"https://crates.io/crates/rutie","tags":["package"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2024-0448.html","tags":["advisory"]},{"url":"https://github.com/danielpclark/rutie/issues/190","tags":["report"]}],"sources":{"osv":[{"id":"RUSTSEC-2024-0448","title":"`parse_arguments` reads a caller-supplied pointer as a slice","description":"`parse_arguments` is safe. It takes `arguments: *const AnyObject` and `argc`, and calls `slice::from_raw_parts(arguments, argc as usize)`.\n\nIt does not check that `arguments` is non-null and aligned, or that `argc` elements are initialized. Safe Rust can pass a null pointer or a length past the allocation. The maintainer confirmed this on 2026-10-03, including a debug abort on Rust 1.78+ when Ruby calls an arity -1 method (`to_s` via `format`, `puts`, or `Array#join`) with a NULL `argv` and `argc` of 0.","status":"published","published":"2024-11-25T12:00:00Z","modified":"2026-10-03T08:15:02.455721883Z","updated_at":"2026-11-02T15:53:39.971022Z"}]}}