Skip to content

Commit

Permalink
Add advisory for double-free in stack_dst
Browse files Browse the repository at this point in the history
  • Loading branch information
ammaraskar committed Mar 3, 2021
1 parent 1794cae commit a0c9d67
Showing 1 changed file with 26 additions and 0 deletions.
26 changes: 26 additions & 0 deletions crates/stack_dst/RUSTSEC-0000-0000.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,26 @@
```toml
[advisory]
id = "RUSTSEC-0000-0000"
package = "stack_dst"
date = "2021-02-22"
url = "https://github.com/thepowersgang/stack_dst-rs/issues/5"
categories = ["memory-corruption"]
keywords = ["memory-safety", "double-free"]

[versions]
patched = [">= 0.6.1"]

[affected]
functions = { "stack_dst::StackA::push_cloned" = ["< 0.6.1"] }
```

# push_cloned can drop uninitialized memory or double free on panic

Affected versions of `stack_dst` used a `push_inner` function that increased
the internal length of the array and then called `val.clone()`.

If the `val.clone()` call panics, the stack could drop an already dropped
element or drop uninitialized memory.

This issue was fixed in `2a4d538` by increasing the length of the array after
elements are cloned.

0 comments on commit a0c9d67

Please sign in to comment.