GHSA-wwxp-hxh6-8gf8: binary_vec_io access memory out-of-bounds in binary_read_to_ref and binary_write_from_ref

The vulnerability lies in two functions, binary_write_from_ref and binary_read_to_ref, within the binary_vec_io crate. These functions are marked as safe, meaning they should not cause undefined behavior regardless of the inputs. However, they both misuse unsafe blocks.

The core of the issue is that both functions accept a reference to a single instance of a generic type T (p: &T or p: &mut T), but also take a usize parameter n that specifies a number of elements to read or write. The functions then proceed to create a slice from the pointer p with a size of n * std::mem::size_of::<T>() bytes. When n is greater than 1, the created slice extends beyond the bounds of the single T that p points to. This leads to out-of-bounds memory access.

For binary_write_from_ref, this results in an out-of-bounds read from the memory region after p. For binary_read_to_ref, this results in an out-of-bounds write into the memory region after p.

This type of memory safety violation can be exploited to cause denial of service through a panic, or potentially lead to arbitrary code execution in some scenarios. The vulnerability is confirmed by the provided gist, which includes a proof-of-concept and Miri's undefined behavior detection output.