Skip to content

RUSTSEC-2026-0184: Potential undefined behavior with Signature from a buffer-created BlameHunk #202

Description

@github-actions
Details
Package git2
Version 0.20.4
Warning unsound
URL rust-lang/git2-rs#1254
Patched Versions >=0.21.0

When a Blame is created via Blame::blame_buffer(), and a BlameHunk is retrieved, the pointers to the original author, original committer, final author, and final committer may be null if unavailable. The corresponding BlameHunk methods then create Signatures based on null pointers; attempting to access the data of the Signatures leads to dereferencing null pointers.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions