Impact

Affected versions of this crate exposed several methods which took self by immutable reference, despite the requesting the RenderDoc API to set a mutable value internally.

This is technically unsound and calling these methods from multiple threads without synchronization could lead to unexpected and unpredictable behavior.

Specifically, the affected methods were:

• renderdoc::api::RenderDocV110::trigger_multi_frame_capture
• renderdoc::api::RenderDocV120::set_capture_file_comments

Patches

This flaw was corrected in release 0.5.0 and newer.

References

• See pull request #32 for the fix and linked issues.
• A corresponding cargo-audit advisory has been filed under RUSTSEC-2019-0018.

For more information

If you have any questions or comments about this advisory:

• Open an issue at the renderdoc-rs repository.
• Email the maintainer at ebkalderon [AT] gmail.com.