Code reviews of the NTRU crate // Lib.rs

RUSTSEC-2023-0032 (unsound) on 2023-03-22: Unsound FFI: Wrong API usage causes write past allocated area

The following usage causes undefined behavior.

let kp: ntru::types::KeyPair = …;
kp.get_public().export(Default::default())

When compiled with debug assertions, the code above will trigger a attempt to subtract with overflow panic before UB occurs. Other mistakes (e.g. using EncParams from a different key) may always trigger UB.

Likely, older versions of this crate are also affected, but have not been tested.

GHSA-fq33-vmhv-48xh

This crate has no reviews yet. To add a review, set up your cargo-crev.

Crates in the crates.io registry are tarball snapshots uploaded by crates' publishers. The registry is not using crates' git repositories. There is absolutely no guarantee that the repository URL declared by the crate belongs to the crate, or that the code in the repository is the code inside the published tarball.

To review the actual code of the crate, it's best to use cargo crev open ntru. Alternatively, you can download the tarball of ntru v0.5.6 or view the source online.