GHSA-qpjr-ch72-2qq4
Use after free in portaudio-rs
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| crates.io | portaudio-rs | < 0.3.2 | 0.3.2 |
Details
As written in the advisory (Markdown source, shown as plain text).
Affected versions of this crate is not panic safe within callback functions stream_callback and stream_finished_callback. The call to user-provided closure might panic before a mem::forget call, which then causes a use after free that grants attacker to control the callback function pointer. This allows an attacker to construct an arbitrary code execution .
References
External links from the advisory. They lead to third-party sites.