RUSTSEC-2026-0302None▾ Sunlit`stack-graphs` C API exports are safe `extern "C"` functions
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
stack_graphs::c is a public module. From 0.0.3 through the current crates.io release 0.14.1, its pointer-taking entry points are pub extern "C" fn rather than unsafe fn. Safe Rust can call them.
sg_stack_graph_free frees the pointer with Box::from_raw. sg_stack_graph_free(std::ptr::null_mut()) is immediate undefined behavior. The same shape is used by the other *_free exports and by getters and mutators that dereference the caller-supplied pointer or pass it to from_raw_parts (sg_stack_graph_nodes, sg_stack_graph_add_edges, and the rest of the pointer-taking functions in src/c.rs). Constructors that take no pointer are not part of this issue.
The upstream repository is archived, so a fix cannot be filed there and no patched release exists. The soundness fix is to make every pointer-taking export unsafe extern "C" fn, with a safety comment that the pointer is non-null and, for free, came from the matching constructor.
stack-graphs >= 0.0.3-0Refer to the advisory for the patched release.
Connected by shared product, vendor, weakness, or advisory.