Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

#

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Jump to bottom

RUSTSEC-2023-0086: Multiple soundness issues #19

Open
github-actions bot opened this issue Sep 17, 2024 · 0 comments
Open

RUSTSEC-2023-0086: Multiple soundness issues #19

github-actions bot opened this issue Sep 17, 2024 · 0 comments

Comments

@github-actions
Copy link

Details
Package lexical-core
Version 0.8.5
Warning unsound
URL n/a
Patched Versions >=1.0.0
Related Advisories RUSTSEC-2023-0055

RUSTSEC-2024-0377 contains multiple soundness issues:

  1. Bytes::read() allows creating instances of types with invalid bit patterns
  2. BytesIter::read() advances iterators out of bounds
  3. The BytesIter trait has safety invariants but is public and not marked unsafe
  4. write_float() calls MaybeUninit::assume_init() on uninitialized data, which is is not allowed by the Rust abstract machine
  5. radix() calls MaybeUninit::assume_init() on uninitialized data, which is is not allowed by the Rust abstract machine

Version 1.0 fixes these issues, removes the vast majority of unsafe code, and also fixes some correctness issues.
# for free to join this conversation on GitHub. Already have an account? # to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
0 participants