Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

#

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Jump to bottom

arenavec: potential double drop or uninitialized memory drop upon panic #815

Merged
merged 2 commits into from
Mar 7, 2021
Merged

arenavec: potential double drop or uninitialized memory drop upon panic #815

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ef52d55
Report 0109-arenavec to RustSec
JOE1994 Mar 7, 2021
c2248b0
arenavec: update advisory title to clarify issue
JOE1994 Mar 7, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 20 additions & 0 deletions crates/arenavec/RUSTSEC-0000-0000.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,20 @@
```toml
[advisory]
id = "RUSTSEC-0000-0000"
package = "arenavec"
date = "2021-01-12"
url = "https://github.com/ibabushkin/arenavec/issues/1"
categories = ["memory-corruption"]

[versions]
patched = []
```

# panic safety: double drop or uninitialized drop of T upon panic

Affected versions of this crate did not guard against potential panics that may happen from user-provided functions `T::default()` and `T::drop()`.

Panic within `T::default()` leads to dropping uninitialized `T`, when it is invoked from `common::Slice::<T, H>::new()`.
Panic within `T::drop()` leads to double drop of `T`, when it is invoked either from `common::SliceVec::<T, H>::resize_with()` or `common::SliceVec::<T, H>::resize()`

Either case causes memory corruption in the heap memory.