{ "item_id": "ker-nanoid_mask", "kernel": "nanoid_mask", "advisory": "RUSTSEC-2024-0343", "crate": "nano-id", "pre_version": "0.3.3", "post_version": "0.4.0", "advisory_url": null, "title": "Reduced entropy due to inadequate character set usage", "source_file": "src/lib.rs", "function": "alphabet_mask", "signature": "pub fn alphabet_mask(len: usize) -> usize", "spec_doc": "Bit mask used to index an alphabet of len symbols (len >= 2) from a random byte: the smallest all-ones value m with m >= len - 1, i.e. next_power_of_two(len) - 1.", "bug_class": "logic", "fidelity": "verbatim_logic", "extraction_note": "src/lib.rs MASK = $len - 1 is not a bit mask for non-power-of-two alphabets (biased/short alphabet)", "witness_args": "62usize", "labels": { "buggy": "nano-id@0.3.3", "reference": "nano-id@0.4.0" } }