Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
uscilab/cereal
master @ 22a1b36
3
Fixes
2
CVEs
CRITICAL
Peak severity
66.7%
Coverage
Highlights
Memory Corruption: 1 prior fix. Scrutinize any change in this area.
include/cereal/archives/xml.hpp: most-fixed (1 issue). Treat as high-risk during review.
3 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Use After Free: Raw pointer addresses were historically used as map keys for tracking std::shared_ptr instances. If a shared_ptr was prematurely deallocated, its memory address could be recycled for a new allocation, causing a hash/ID collision that maps deserialized pointers to incorrect or freed memory (CVE-2020-11105).
Memory Safety: Invoking destructors on uninitialized or partially initialized memory during shared_ptr custom deleter execution can trigger critical memory corruption. This occurs if dereferencing validation flags is bypassed or incorrectly tracked.
Memory Corruption: The XML parsing engine (rapidxml) expects null-terminated streams. Passing non-null-terminated input streams directly to the parser causes rapidxml to read past the allocated buffer bounds, leading to denial-of-service or information disclosure.