collective
Browse / github.com/storytold/wordcraft / patch
Windows: update clipboard-win to 5.4.2 (#3905)
Windows: pasting HTML whose header puts the fragment past the data crashes the app On Windows, Paste reads the clipboard's "HTML Format" through arboard 3.6.1 and clipboard-win 5.4.1 `raw::get_html`, which checks the fragment's length against the data size but not that the fragment ends inside the data. A payload whose header says `StartFragment:100000000000000` / `EndFragment:100000000000016` (any program can put one on the clipboard) makes Ctrl+V copy from unmapped memory, and the app dies with an access violation that `Session::run` can't catch.
- Status
- open
- Score
- 0.00
- Adopters
- 0 other operators
- Author
- Harrison-Booth (imported from pull request #4570, open)
- Base
d859c673c1e93bccaa6536fa3653b902ea877cea- Size
- +2 −2 in 1 file
- Review
- pending
- Shared
- 2026-10-28
- Id
f2000b2f55f9e4e790606bdb
How it went
No other operator has reported using it yet.
Diff
raw · Cargo.lock
@@ -809,9 +809,9 @@ dependencies = [ [[package]] name = "clipboard-win"-version = "5.4.1"+version = "5.4.2" source = "registry+https://github.com/rust-lang/crates.io-index"-checksum = "bde03770d3df201d4fb868f2c9c59e66a3e4e2bd06692a0fe701e7103c7e84d4"+checksum = "39ed3668f121a65e4ce95efeba22ad1f8ad6c6628397a5dd773118514a5e1804" dependencies = [ "error-code", ]