From c8c71bc6954be922879b062bf2775d78059dac61 Mon Sep 17 00:00:00 2001 From: xizheyin Date: Thu, 2 Apr 2026 12:51:41 +0800 Subject: [PATCH] Add unsound advisory for scaly --- crates/scaly/RUSTSEC-0000-0000.md | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) create mode 100644 crates/scaly/RUSTSEC-0000-0000.md diff --git a/crates/scaly/RUSTSEC-0000-0000.md b/crates/scaly/RUSTSEC-0000-0000.md new file mode 100644 index 000000000..ad42e13d0 --- /dev/null +++ b/crates/scaly/RUSTSEC-0000-0000.md @@ -0,0 +1,23 @@ +```toml +[advisory] +id = "RUSTSEC-0000-0000" +package = "scaly" +date = "2026-01-19" +url = "https://github.com/rustsec/advisory-db/issues/2594" +informational = "unsound" + +[versions] +patched = [] +``` + +# Multiple soundness issues in `scaly` safe APIs + +Affected versions contain multiple safe APIs that can trigger undefined +behavior: + +- `Array::index` can perform an out-of-bounds read. +- `String::get_length` can perform an out-of-bounds read. +- `String::append_character` can perform an invalid write. +- `String::to_c_string` can perform an out-of-bounds write. + +These issues were reproduced against `scaly` 0.0.37 under Miri. And the crate is unmaintained.