Please, release a new version

[eduardosm]

The implementation of the data and data_mut functions is highly unsafe:

rust-traitobject/src/lib.rs

Lines 13 to 22 in a8a36dc

	pub unsafe fn data<T: ?Sized>(val: *const T) -> *const () {
	*mem::transmute::<*const *const T, *const *const ()>(&val)
	}
	/// Get the data pointer from this trait object, mutably.
	///
	/// Highly unsafe, as there is no information about the type of the data.
	pub unsafe fn data_mut<T: ?Sized>(mut val: *mut T) -> *mut () {
	*mem::transmute::<*mut *mut T, *mut *mut ()>(&mut val)
	}

This assumes that the first element is a fat pointer is the data pointer. This is currently true, but it can change in a newer rust version, which would make this crate a potential security hole.

Commit 99b1993 fixed this, but it has not been released into a new version. Please, publish a new version (0.1.1) that includes this commit (and possibly yank the previous versions).

[willfindlay]

@reem This is currently the subject of a security advisory. Would you consider addressing this?

[philip-peterson]

Because it seems this repository is unmaintained, I have forked it with the submitted patches and issues merged here: https://github.com/philip-peterson/destructure_traitobject

[zonyitoo]

@reem Hi, would you consider make a new release for this? There are many creates depending on this.

[GuilleAmutio]

@reem Hi, would you consider make a new release for this? There are many creates depending on this.

+1

[shelvacu]

As a workaround, put this in Cargo.toml:

[patch.crates-io]
traitobject = { git = "https://github.com/reem/rust-traitobject", rev = "b3471a15917b2caf5a8b27debb0b4b390fc6634f" }

to pull in the merged-but-never-released-on-cargo fix

[fralalonde]

I've re-forked destructure_traitobject and made it useable for transitive patching of traitobject

Similar to @shelvacu 's previous workaround, put this in the top Cargo.toml:

[patch.crates-io]
traitobject = { git = "https://github.com/fralalonde/traitobject_patch", tag = "0.1.1" }

I'll do my best to keep it updated.

This fork also fixes warnings for Rust 2021 edition as identified in #8.

See https://github.com/fralalonde/traitobject_patch for details.