Skip to content

RUSTSEC-2026-0184: Potential undefined behavior with Signature from a buffer-created BlameHunk #3339

Description

@github-actions

Potential undefined behavior with Signature from a buffer-created BlameHunk

Details
Status unsound
Package git2
Version 0.20.4
URL rust-lang/git2-rs#1254
Date 2026-05-13

When a Blame is created via Blame::blame_buffer(), and a BlameHunk is retrieved, the pointers to the original author, original committer, final author, and final committer may be null if unavailable. The corresponding BlameHunk methods then create Signatures based on null pointers; attempting to access the data of the Signatures leads to dereferencing null pointers.

See advisory page for additional details.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions