OMGeeky/advisory-db
1
0
Fork 0
mirror of https://github.com/OMGeeky/advisory-db.git synced 2025-12-31 16:50:28 +01:00
Code Issues Packages Projects Releases Wiki Activity

eventio: Input<R>' can send non-Send types to other threads

Browse Source
This commit is contained in:
JOE1994
2021-01-19 10:45:33 -05:00
parent 3fbe06486f
commit 1e1e0538a8
1 changed files with 20 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
crates/eventio/RUSTSEC-0000-0000.md Normal file
View File

@@ -0,0 +1,20 @@
```toml
[advisory]
id = "RUSTSEC-0000-0000"
package = "eventio"
date = "2020-12-20"
url = "https://github.com/petabi/eventio/issues/33"
categories = ["memory-corruption"]
[versions]
patched = []
```
# Soundness issue: Input<R> can be misused to create data race to an object
`Input<R>` implements `Send` without requiring `R: Send`.
Affected versions of this crate allows users to send non-Send types to other threads,
which can lead to undefined behavior such as data race and memory corruption.
The flaw was corrected in the PR(https://github.com/petabi/eventio/pull/34) by adding `R: Send` bound to the `Send` impl of `Input<R>`.