PT-2026-39707
تاريخ النشر
2026-04-23
·
تاريخ التحديث
2026-04-23
الوصف من
الدرجة
N/A
غير متوفرلا تتوفر حاليًا تقييمات أو مقاييس للخطورة. سنحدّث المعلومات المقابلة في الصفحة فور توفرها.
InlineVec::clear() and SerVec::clear() in rkyv were not panic-safe.
Both functions iterate over their elements and call drop in place on each,
updating self.len only after the loop. If an element's Drop implementation
panics during the loop, self.len is left at its original value.A subsequent invocation of
clear() on the same container then re-visits the
already-freed elements:InlineVec::clear()is called again fromInlineVec's ownDropimplementation when the value is later dropped.SerVec::clear()is called again bySerVec::with capacity()after the user closure returns.
Impact
- CWE-415 (Double Free): heap corruption when the element type is one that
owns memory, such as
Box<T>orVec<T> - CWE-416 (Use-After-Free): memory corruption when an element is accessed following a caught panic
Both types of undefined behavior can be invoked in safe Rust, but only if
unwinding panics are enabled and
std::panic::catch unwind is used.المورّدون
المنتجات المتأثرة
المعرّفات ذات الصلة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾