GHSA-pfr9-2p92-qrhq: 
Rust vulnerability analysis and mitigation

The Databento Binary Encoding (DBN) library contains a heap buffer overflow vulnerability in its c_chars_to_str function, identified as GHSA-pfr9-2p92-qrhq. The vulnerability was discovered and reported on October 7, 2024, and affects versions prior to 0.22.0. The issue stems from improper handling of C-string conversions where the code assumes input strings are null-terminated without verification (GitHub Advisory, RustSec Advisory).

The vulnerability occurs in the c_chars_to_str function when converting character arrays to strings. The function uses CStr::from_ptr() which assumes the input is a null-terminated string. However, when the input array lacks a null terminator (\0), the strlen() function reads beyond the buffer's boundaries searching for one, resulting in an out-of-bounds memory read. The issue has been assigned a CVSS score of 6.8 (Moderate severity) with attack vector being Local, attack complexity Low, and requiring Low privileges (GitHub Advisory).

When exploited, this vulnerability can lead to memory corruption or potential exposure of sensitive information through out-of-bounds memory reads. The primary impact is on system availability, with the CVSS metrics indicating High impact on availability but no direct impact on confidentiality or integrity (GitHub Advisory, RustSec Advisory).

The vulnerability has been patched in version 0.22.0 of the DBN library. The fix involves adding proper bounds checking to ensure the input array contains a valid null-terminated string before processing. Users are advised to upgrade to version 0.22.0 or later to address this security issue (GitHub Commit).