RUSTSEC-2021-0112: 
Rust vulnerability analysis and mitigation

The tectonic_xdv crate before version 0.1.12 for Rust contains a memory safety vulnerability where XdvParser::process() method creates an uninitialized buffer and passes it to user-provided Read implementation. This could lead to undefined behavior by allowing safe Rust code to read from uninitialized memory locations. The vulnerability was discovered in February 2021 by the Rust group at Georgia Tech (SSLAB).

The vulnerability exists in the XdvParser::process() method where it creates a buffer using Vec::with_capacity() and sets its length using unsafe set_len() before properly initializing it. This uninitialized buffer is then passed to a user-provided Read implementation, which violates the safety requirements of the Read trait that requires buffers to be initialized before calling read() (SSLAB).

Reading from uninitialized memory locations can lead to undefined behavior in safe Rust code, potentially causing memory corruption, crashes, or other security issues (SSLAB).

The vulnerability requires providing a malicious Read implementation that attempts to read from the uninitialized portions of the buffer. While no known exploits exist in the wild, the issue is inherent in the code design (SSLAB).

The recommended fix is to ensure buffers are properly initialized before being passed to Read implementations. A naive but safe approach is to zero-initialize the buffer, though this adds runtime performance overhead. As of February 2021, there was no ideal zero-cost fix available. Users should upgrade to version 0.1.12 or later which contains the fix (SSLAB).