Advisory Database
  • Advisories
  • Dependency Scanning
  1. cargo
  2. ›
  3. xmp_toolkit
  4. ›
  5. GHSA-66fw-43h8-f8p3

GHSA-66fw-43h8-f8p3: XMP Toolkit's `XmpFile::close` can trigger undefined behavior

July 26, 2024

Affected versions of the crate failed to catch C++ exceptions raised within the XmpFile::close function. If such an exception occured, it would trigger undefined behavior, typically a process abort.

This is best demonstrated in issue #230, where a race condition causes the close call to fail due to file I/O errors.

This was fixed in PR #232 (released as crate version 1.9.0), which now safely handles the exception.

For backward compatibility, the existing API ignores the error. A new API XmpFile::try_close was added to allow callers to receive and process the error result.

Users of all prior versions of xmp_toolkit are encouraged to update to version 1.9.0 to avoid undefined behavior.

References

  • github.com/adobe/xmp-toolkit-rs
  • github.com/adobe/xmp-toolkit-rs/issues/230
  • github.com/adobe/xmp-toolkit-rs/issues/233
  • github.com/adobe/xmp-toolkit-rs/pull/232
  • github.com/advisories/GHSA-66fw-43h8-f8p3
  • rustsec.org/advisories/RUSTSEC-2024-0360.html

Code Behaviors & Features

Detect and mitigate GHSA-66fw-43h8-f8p3 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions before 1.9.0

Fixed versions

  • 1.9.0

Solution

Upgrade to version 1.9.0 or above.

Weakness

  • CWE-754: Improper Check for Unusual or Exceptional Conditions

Source file

cargo/xmp_toolkit/GHSA-66fw-43h8-f8p3.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Wed, 14 May 2025 12:14:49 +0000.