[GHSA-mrrw-grhq-86gf] Ascii (crate) allows out-of-bounds array indexing in safe code

[RainSignal]

Updates

• Affected products
• CWEs

Comments

1. Affected versions corrected

The advisory states affected versions start from 0.6.0, but code
review shows this is incorrect.

Version 0.6.0 was verified to NOT contain the vulnerable code:
https://github.com/tomprogrammer/rust-ascii/blob/0.6.0/src/lib.rs

The file only contains immutable AsRef trait implementations, with
no impl_into! macro and no mutable From implementations.

Version 0.7.0 was verified to contain the vulnerable code:
https://github.com/tomprogrammer/rust-ascii/blob/v0.7.0/src/ascii_str.rs

The impl_into! macro in 0.7.0 generates both of the unsound
implementations:

• impl From<&mut AsciiStr> for &mut [u8]
• impl From<&mut AsciiStr> for &mut str

Therefore the affected version range should start from 0.7.0,
not 0.6.0.

2. Weakness corrected

The current advisory has no CWE assigned. The correct weakness is
CWE-119 (Improper Restriction of Operations within the Bounds of a
Memory Buffer), as the unsound mutable From implementations allow
writing non-ASCII bytes into an AsciiStr, which when later read as
AsciiChar produces values outside the valid niche, causing
out-of-bounds array indexing in safe code.