Executive brief
stack-graphs is a Rust library that provides a C API for code analysis. Safe Rust code can directly call unsafe C-compatible functions that accept pointers, including functions that free memory or dereference pointers without validation. Passing a null pointer to memory-deallocation functions or invalid pointers to accessor functions causes immediate undefined behavior, which could lead to crashes or memory corruption.
Technical details
The stack_graphs::c module exports pointer-taking functions as safe pub extern "C" fn rather than unsafe extern "C" fn, violating Rust's soundness guarantees. Functions like sg_stack_graph_free call Box::from_raw without null-pointer checks, and other pointer-taking functions dereference caller-supplied pointers directly. The vulnerability affects all pointer-taking exports in src/c.rs and can be triggered by any caller with access to the C API. No patched version exists; the upstream repository is archived.
Affected products
- GitHub stack-graphs 0.0.3 through 0.14.1
Timeline
- 2026-09-22: disclosed