otake84/messagepack-rs · Security
Deserialization functions pass uninitialized memory to user-provided Read
- GHSA ID
- GHSA-m325-rxjv-pwph
- Severity
- high
- Published
- Updated
Description
Affected versions of this crate passed an uninitialized buffer to a
user-provided Read instance in:
deserialize_binarydeserialize_stringdeserialize_extension_othersdeserialize_string_primitive
This can result in safe Read implementations reading from the uninitialized
buffer leading to undefined behavior.