From e848a1ce83af5c07dbffd280ba2868ed3b3b16ac Mon Sep 17 00:00:00 2001 From: Daniel Scherzer Date: Sat, 16 May 2026 14:50:04 -0700 Subject: [PATCH] Add advisory for git2: Remote::list() with an empty list triggers UB --- crates/git2/RUSTSEC-0000-0000.md | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) create mode 100644 crates/git2/RUSTSEC-0000-0000.md diff --git a/crates/git2/RUSTSEC-0000-0000.md b/crates/git2/RUSTSEC-0000-0000.md new file mode 100644 index 0000000000..9b1b89cf2e --- /dev/null +++ b/crates/git2/RUSTSEC-0000-0000.md @@ -0,0 +1,16 @@ +```toml +[advisory] +id = "RUSTSEC-0000-0000" +package = "git2" +date = "2026-05-12" +url = "https://github.com/rust-lang/git2-rs/pull/1250" +informational = "unsound" +keywords = ["git2"] + +[versions] +patched = ["> 0.20.4"] +``` + +# Potential undefined behavior when calling Remote::list() + +When calling `Remote::list()` for a remote of a git repository, when that remote does not advertise any references, git2 passes a null pointer to the unsafe function `slice::from_raw_parts()`. Based on the safety section documentation of function, data must be non-null even for slices of length zero. Thus, the use of a null pointer leads to undefined behavior.