RUSTSEC-2026-0400: Use-after-free of a dictionary after a one-shot call on a context with an open stream
维护者通常 4 天内回复
还没有人认领这个 Issue。
评估
调研方向
The report describes a use-after-free in zstd-safe one-shot calls when a context has an unfinished stream, but it does not identify files or tests in this repository. First trace where the client uses DCtx or CCtx and how it mixes one-shot and streaming operations. Done means establishing whether this project can hit the reported pattern and, if so, adding coverage and handling it safely.
由索引模型根据 Issue 内容生成。
描述
| Details | |
|---|---|
| Package | zstd-safe |
| Version | 5.0.2+zstd.1.5.2 |
| Warning | unsound |
| URL | https://github.com/gyscos/zstd-rs/commit/d34502a0ed07f80ab2aa4c65059578e0466f2467 |
| Patched Versions | >=8.2.0 |
| Unaffected Versions | <3.0.1 |
The one-shot DCtx and CCtx methods assumed the C library resets the
context, but it leaves an open stream as it is. When a stream was left
unfinished on a context, a one-shot call such as decompress_using_dict
could leave the context pointing at the dictionary borrowed for that call,
and the next streaming call resumed the stream against it after it was
freed: decompressed output then contained freed heap memory. On the
compression side, the stream resumed against the one-shot call's buffers.
This requires an application to use one context for both streaming and
one-shot calls without a reset in between. The flaw was corrected by
resetting the session after one-shot calls whenever a stream may be open.
- 主要语言
- Rust
- 星标
- 10
- 派生
- 8
- 平均合并
- 6 天 3 小时
- 30 天内合并 PR
- 3
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
bitcoindevkit/electrum_streaming_client 的其他 Issue
-
难度 2/5 1-3 小时 新手友好度 75/100
bitcoindevkit/electrum_streaming_client#68 ·
维护者通常 4 天内回复
-
RUSTSEC-2026-0386: `AsyncFd::new` and related constructors violate I/O safety可能已有人在做 @noahjoeris 于 1 天前认领。 未关闭
难度 2/5 1-3 小时 新手友好度 70/100
bitcoindevkit/electrum_streaming_client#57 ·
维护者通常 4 天内回复
-
难度 2/5 1-3 小时 新手友好度 85/100
bitcoindevkit/electrum_streaming_client#56 ·
维护者通常 4 天内回复
-
documentation
难度 1/5 1-3 小时 新手友好度 78/100
bitcoindevkit/electrum_streaming_client#29 ·
维护者通常 4 天内回复
-
难度 3/5 1-2 天 新手友好度 40/100
bitcoindevkit/electrum_streaming_client#67 ·
维护者通常 4 天内回复
查看 bitcoindevkit/electrum_streaming_client 的全部 Issue
相似的 Issue
-
难度 2/5 1-3 小时 新手友好度 83/100
维护者通常 1 天内回复
-
priority middle
难度 1/5 1 小时以内 新手友好度 62/100
KATO-Hiro/AtCoderClans#12940 ·
维护者通常 1 天内回复
-
bug
难度 2/5 1-3 小时 新手友好度 83/100
维护者通常 1 天内回复
-
o8 next debug build aborts on Glass to Dark appearance switch (nil identifier messaged before check)未关闭bug
难度 2/5 1-3 小时 新手友好度 78/100
hurttlocker/o8#5112 ·
-
难度 2/5 1-3 小时 新手友好度 79/100
维护者通常 1 天内回复