Skip to content

Commit 8e06121

Browse files
Copilotdoublegate
Copilot
and
doublegate
authored
Fix RUSTSEC-2026-0002: Patch lru soundness vulnerability in iced_glyphon (#61)
* Initial plan * Fix RUSTSEC-2026-0002: Patch lru vulnerability in iced_glyphon Co-authored-by: doublegate <[email protected]> * Add documentation for RUSTSEC-2026-0002 security fix Co-authored-by: doublegate <[email protected]> --------- Co-authored-by: copilot-swe-agent[bot] <[email protected]> Co-authored-by: doublegate <[email protected]>
1 parent d8a10b1 commit 8e06121

24 files changed

+2227
-11
lines changed

‎Cargo.lock‎

Lines changed: 2 additions & 10 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎Cargo.toml‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -107,4 +107,10 @@ strip = true
107107

108108
[profile.bench]
109109
opt-level = 3
110-
debug = false
110+
debug = false
111+
112+
# Security fix for RUSTSEC-2026-0002: IterMut violates Stacked Borrows
113+
# Patch vulnerable lru 0.12.5 by replacing iced_glyphon with patched version
114+
# The patched version updates lru from 0.12.1 to 0.16.3 which includes the security fix
115+
[patch.crates-io]
116+
iced_glyphon = { path = "vendor/iced_glyphon" }

‎SECURITY-FIX-RUSTSEC-2026-0002.md‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
# Security Fix: RUSTSEC-2026-0002
2+
3+
## Summary
4+
5+
Fixed a soundness vulnerability in the `lru` crate (version 0.12.5) used as a transitive dependency through `iced_glyphon`.
6+
7+
## Vulnerability Details
8+
9+
- **Advisory**: RUSTSEC-2026-0002
10+
- **Package**: `lru`
11+
- **Affected Versions**: 0.9.0 to 0.16.2 (inclusive)
12+
- **Patched Version**: 0.16.3+
13+
- **Severity**: Unsound (memory safety issue)
14+
- **Issue**: `IterMut` violates Stacked Borrows by invalidating internal pointer
15+
16+
### Technical Description
17+
18+
The `IterMut` iterator implementation in the vulnerable lru versions temporarily creates an exclusive reference (`&mut`) to the key when dereferencing the internal node pointer. This invalidates the shared pointer (`&`) held by the internal `HashMap`, violating Rust's Stacked Borrows rules and potentially causing undefined behavior.
19+
20+
## Dependency Chain
21+
22+
```
23+
rustirc v0.3.8
24+
└── rustirc-gui v0.3.8
25+
└── iced v0.13.1
26+
└── iced_wgpu v0.13.5
27+
└── iced_glyphon v0.6.0
28+
└── lru v0.12.5 ← VULNERABLE
29+
```
30+
31+
## Solution Implemented
32+
33+
Since `iced_glyphon` v0.6.0 depends on `lru ^0.12.1` and there's no newer version of `iced_glyphon` available that uses the patched lru, we implemented a vendor patch:
34+
35+
1. **Downloaded** `iced_glyphon` v0.6.0 source code
36+
2. **Modified** `Cargo.toml` to update lru dependency from `0.12.1` to `0.16.3`
37+
3. **Vendored** the patched version in `vendor/iced_glyphon/`
38+
4. **Applied** Cargo patch in workspace `Cargo.toml`:
39+
```toml
40+
[patch.crates-io]
41+
iced_glyphon = { path = "vendor/iced_glyphon" }
42+
```
43+
44+
## Verification
45+
46+
Before fix:
47+
```
48+
lru v0.12.5 ← Vulnerable
49+
└── iced_glyphon v0.6.0
50+
```
51+
52+
After fix:
53+
```
54+
lru v0.16.3 ← Patched
55+
└── iced_glyphon v0.6.0 (vendored)
56+
```
57+
58+
## Testing
59+
60+
- ✅ Clean build successful
61+
- ✅ All tests passing
62+
- ✅ Clippy clean (no warnings)
63+
- ✅ No vulnerable lru versions in dependency tree
64+
65+
## Future Maintenance
66+
67+
This vendor patch can be removed when:
68+
- `iced_glyphon` releases a version with lru 0.16.3+
69+
- Upgrading to iced 0.14+ (which may use different text rendering)
70+
- Switching to `cryoglyph` (iced-rs fork with updated dependencies)
71+
72+
## References
73+
74+
- RustSec Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0002
75+
- GitHub Advisory: https://github.com/advisories/GHSA-rhfx-m35p-ff5j
76+
- lru-rs Fix PR: https://github.com/jeromefroe/lru-rs/pull/224
77+
- Affected Package: https://crates.io/crates/lru/0.12.5
78+
- Patched Package: https://crates.io/crates/lru/0.16.3
79+
80+
## Files Modified
81+
82+
- `Cargo.toml`: Added `[patch.crates-io]` section
83+
- `Cargo.lock`: Updated lru dependency to 0.16.3
84+
- `vendor/`: Added patched iced_glyphon source
85+
- `vendor/README.md`: Documentation for vendored dependencies

‎vendor/README.md‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
# Vendored Dependencies
2+
3+
This directory contains vendored copies of dependencies that have been patched for security or compatibility reasons.
4+
5+
## iced_glyphon
6+
7+
**Reason**: Security patch for RUSTSEC-2026-0002
8+
**Original version**: 0.6.0
9+
**Issue**: The original iced_glyphon 0.6.0 depends on lru 0.12.5, which contains a soundness bug where `IterMut` violates Stacked Borrows by invalidating internal pointers.
10+
11+
**Changes made**:
12+
- Updated `lru` dependency from 0.12.1 to 0.16.3 in Cargo.toml
13+
14+
**Affected versions**: lru 0.9.0 - 0.16.2
15+
**Fixed version**: lru 0.16.3+
16+
17+
**Upstream tracking**:
18+
- RustSec Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0002
19+
- lru-rs PR #224: https://github.com/jeromefroe/lru-rs/pull/224
20+
- iced_glyphon issue: https://github.com/hecrj/glyphon (no newer version available yet)
21+
22+
**Future**: This patch can be removed once iced_glyphon releases a version that depends on lru 0.16.3 or higher, or when upgrading to iced 0.14+ which may use a different text rendering backend.

‎vendor/iced_glyphon/.cargo_vcs_info.json‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
{
2+
"git": {
3+
"sha1": "647575039c86faf21518c3064f9dde2dacf16db7"
4+
},
5+
"path_in_vcs": ""
6+
}

‎vendor/iced_glyphon/.github/FUNDING.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
github: [grovesNL]

‎vendor/iced_glyphon/.github/workflows/ci.yml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
name: CI
2+
3+
on:
4+
push:
5+
branches: [main]
6+
pull_request:
7+
branches: [main]
8+
9+
env:
10+
CARGO_TERM_COLOR: always
11+
12+
jobs:
13+
build:
14+
runs-on: ubuntu-latest
15+
16+
steps:
17+
- uses: actions/checkout@v3
18+
- name: Build
19+
run: cargo build --verbose
20+
- name: Run tests
21+
run: cargo test --verbose

‎vendor/iced_glyphon/.gitignore‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
/target
2+
.vscode
3+
Cargo.lock

‎vendor/iced_glyphon/Cargo.toml‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
# THIS FILE IS AUTOMATICALLY GENERATED BY CARGO
2+
#
3+
# When uploading crates to the registry Cargo will automatically
4+
# "normalize" Cargo.toml files for maximal compatibility
5+
# with all versions of Cargo and also rewrite `path` dependencies
6+
# to registry (e.g., crates.io) dependencies.
7+
#
8+
# If you are reading this file be aware that the original Cargo.toml
9+
# will likely look very different (and much more reasonable).
10+
# See Cargo.toml.orig for the original contents.
11+
12+
[package]
13+
edition = "2021"
14+
name = "iced_glyphon"
15+
version = "0.6.0"
16+
build = false
17+
autobins = false
18+
autoexamples = false
19+
autotests = false
20+
autobenches = false
21+
description = "Fast, simple 2D text rendering for wgpu"
22+
homepage = "https://github.com/hecrj/glyphon.git"
23+
readme = "README.md"
24+
license = "MIT OR Apache-2.0 OR Zlib"
25+
repository = "https://github.com/hecrj/glyphon"
26+
27+
[lib]
28+
name = "iced_glyphon"
29+
path = "src/lib.rs"
30+
31+
[[example]]
32+
name = "hello-world"
33+
path = "examples/hello-world.rs"
34+
35+
[dependencies.cosmic-text]
36+
version = "0.12"
37+
38+
[dependencies.etagere]
39+
version = "0.2.10"
40+
41+
[dependencies.lru]
42+
version = "0.16.3"
43+
default-features = false
44+
45+
[dependencies.rustc-hash]
46+
version = "2.0"
47+
48+
[dependencies.wgpu]
49+
version = "0.19"
50+
features = ["wgsl"]
51+
default-features = false
52+
53+
[dev-dependencies.pollster]
54+
version = "0.3.0"
55+
56+
[dev-dependencies.wgpu]
57+
version = "0.19"
58+
default-features = true
59+
60+
[dev-dependencies.winit]
61+
version = "0.29.10"
62+
features = ["rwh_05"]

0 commit comments

Comments
 (0)