diff --git a/crates/aeron/RUSTSEC-0000-0000.md b/crates/aeron/RUSTSEC-0000-0000.md new file mode 100644 index 0000000000..d7176dcf45 --- /dev/null +++ b/crates/aeron/RUSTSEC-0000-0000.md @@ -0,0 +1,23 @@ +```toml +[advisory] +id = "RUSTSEC-0000-0000" +package = "aeron" +date = "2026-05-02" +url = "https://github.com/UnitedTraders/aeron-rs/issues/31" +informational = "unsound" +categories = ["memory-corruption"] +keywords = ["out-of-bounds", "segfault"] + +[versions] +patched = [] +``` + +# Out-of-bounds memory access in `MemoryMappedFile::atomic_buffer()` + +`MemoryMappedFile::atomic_buffer()` performs unchecked pointer arithmetic +without validating that the offset + length fits within the mapped file size. +Passing an offset far beyond the file size causes a segmentation fault on +subsequent buffer operations. + +This can be triggered through safe public APIs — `atomic_buffer()` is a safe +method — with no `unsafe` required from the caller. \ No newline at end of file