os_str_bytes relies on undefined behavior of `char::from_u32_unchecked`
High severity
GitHub Reviewed
Published
Aug 25, 2021
to the GitHub Advisory Database
•
Updated Jun 13, 2023
Description
Published by the National Vulnerability Database
Dec 31, 2020
Reviewed
Aug 19, 2021
Published to the GitHub Advisory Database
Aug 25, 2021
Last updated
Jun 13, 2023
The Windows implementation of this crate relied on the behavior of std::char::from_u32_unchecked when its safety clause is violated. Even though this worked with Rust versions up to 1.42 (at least), that behavior could change with any new Rust version, possibly leading a security issue.
The flaw was corrected in version 2.0.0.
References