CVE-2020-36452

Name of the Vulnerable Software and Affected Versions array-tools crate versions prior to 0.3.2

Description An issue in the array-tools crate causes memory corruption due to the drop of uninitialized memory when T::clone() panics in FixedCapacityDequeLike<T, A>::clone(). This occurs because affected versions of the crate do not guard against panics, leading to the partial initialization of a buffer that is then dropped. The FixedCapacityDequeLike::clone() function is specifically affected.

Recommendations For versions prior to 0.3.2, update to version 0.3.2 or later to resolve the issue. As a temporary workaround, consider implementing panic handling for T::clone() to prevent the drop of uninitialized memory in FixedCapacityDequeLike<T, A>::clone().