See how ejmahler compares to other vendors in security performance
Given the function transpose::transpose: rust fn transpose<T: Copy>(input: &[T], output: &mut [T], inputwidth: usize, inputheight: usize)
The safety check inputwidth inputheight == output.len() can fail due to inputwidth inputheight overflowing in such a way that it equals output.len(). As a result of failing the safety check, memory past the end of output is written to. This only occurs in release mode since panics on overflow in debug mode.
Exploiting this issue requires the caller to pass inputwidth and inputheight arguments such that multiplying them overflows, and the overflown result equals the lengths of input and output slices.