PT-2026-80710 · Crates.Io · Sp-Sized-Chunks
Published
2026-08-11
·
Updated
2026-08-11
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
Several methods in
sp-sized-chunks drop elements before updating the container's length/boundary metadata. If an element's Drop panics during the drop, the metadata update is skipped, so the container still treats the already-dropped elements as live. When the container is later dropped, its own Drop re-visits those slots and drops the freed elements again — a use-after-free / double-free reachable from safe Rust.sp-sized-chunks is a fork of sized-chunks (companion advisory filed separately) and carries the same bug. The repository is archived and the crate is still on 0.1.0 with no fix available.Impact
- CWE-415 (Double Free): the same allocation is freed twice (e.g. an element holding
Box<T>). - CWE-416 (Use-After-Free): an element reads its own freed allocation during
Drop(e.g.String) — confirmed under AddressSanitizer.
All are reachable from safe Rust via
catch unwind with element types whose Drop can panic. Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Sp-Sized-Chunks