Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

#

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Jump to bottom

Add advisory for rust-lang/rust#78498 #561

Closed
wants to merge 2 commits into from
Closed

Add advisory for rust-lang/rust#78498 #561

wants to merge 2 commits into from

Conversation

Qwaz
Copy link
Contributor

@Qwaz Qwaz commented Jan 13, 2021

Advisory for:
String::retain allows safely creating invalid (non-utf8) strings when abusing panic (rust-lang/rust#78498)

@Qwaz Qwaz force-pushed the std-string-retain branch from e8b5db9 to 8e76d3d Compare January 13, 2021 16:00
@Qwaz
Copy link
Contributor Author

Qwaz commented Jan 13, 2021

It seems that the linter doesn't understand alloc::string::String::retain. Should I just put std::string::String::retain?

@tarcieri
Copy link
Member

Yes. Right now the linter requires the path begins with the same crate as the advisory is filed against.

Alternatively you could file it against alloc

@Qwaz
Copy link
Contributor Author

Qwaz commented Jan 13, 2021

Updated the PR to use std, considering that alloc became stable in Rust 1.36.0.

@Qwaz Qwaz closed this Feb 3, 2021
@Qwaz Qwaz deleted the std-string-retain branch February 3, 2021 16:15
@Qwaz
Copy link
Contributor Author

Qwaz commented Feb 3, 2021

I'll reopen the PR when we have CVEs

@Qwaz Qwaz mentioned this pull request Apr 8, 2021
Closed
# for free to join this conversation on GitHub. Already have an account? # to comment
Reviewers

@tarcieri tarcieri tarcieri left review comments

@pietroalbini pietroalbini pietroalbini left review comments

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@Qwaz @tarcieri @pietroalbini