Deps.rs

rodio 0.22.2

This project might be open to known security vulnerabilities, which can be prevented by tightening the version range of affected dependencies. Find detailed information at the bottom.

Crate rodio

Dependencies

(15 total, 1 possibly insecure)

CrateRequiredLatestStatus
 atomic_float^1.1.01.1.0up to date
 claxon ⚠️^0.40.4.3maybe insecure
 cpal^0.170.17.3up to date
 crossbeam-channel^0.5.150.5.15up to date
 dasp_sample^0.110.11.0up to date
 hound^3.53.5.1up to date
 lewton^0.100.10.2up to date
 minimp3_fixed^0.5.40.5.4up to date
 num-rational^0.4.20.4.2up to date
 rand^0.100.10.0up to date
 rand_distr^0.60.6.0up to date
 rtrb^0.3.20.3.3up to date
 symphonia^0.5.50.5.5up to date
 thiserror^22.0.18up to date
 tracing^0.1.400.1.44up to date

Dev dependencies

(6 total, all up-to-date)

CrateRequiredLatestStatus
 approx^0.5.10.5.1up to date
 divan^0.1.140.1.21up to date
 inquire^0.9.30.9.4up to date
 quickcheck^11.1.0up to date
 rstest^0.260.26.1up to date
 rstest_reuse^0.70.7.0up to date

Security Vulnerabilities

claxon: Malicious input could cause uninitialized memory to be exposed

RUSTSEC-2018-0004

Affected versions of Claxon made an invalid assumption about the decode buffer size being a multiple of a value read from the bitstream. This could cause parts of the decode buffer to not be overwritten. If the decode buffer was newly allocated and uninitialized, this uninitialized memory could be exposed.

This allows an attacker to observe parts of the uninitialized memory in the decoded audio stream.

The flaw was corrected by checking that the value read from the bitstream divides the decode buffer size, and returning a format error if it does not. If an error is returned, the decode buffer is not exposed. Regression tests and an additional fuzzer have been added to prevent similar flaws in the future.