Report memory exposure in PyO3 nth_back iterator methods

[davidhewitt]

Affected crate(s)

• pyo3 (40M recent downloads per crates.io)

Links to upstream issue(s) or PR(s)

PyO3/pyo3#6086

Severity

Code that uses BoundListIterator and BoundTupleIterator's nth_back methods with attacker-controlled N are vulnerable to out-of-bound reads if the iterators have already yielded items.

My assessment is that this is a relatively niche iterator method with a couple of conditions to make it a problem, but code meeting the vulnerable combination could easily go undetected and deserves both a fix and an advisory.

Checklist

• Advisory filename(s) starts with RUSTSEC-0000-0000 as the ID
• date field is set to the public disclosure date
• Contains a concise and descriptive title after advisory metadata
• Asked maintainer(s) if publishing an advisory is appropriate

[djc]

Thanks!