OMGeeky/advisory-db
1
0
Fork 0
mirror of https://github.com/OMGeeky/advisory-db.git synced 2025-12-31 00:30:25 +01:00
Code Issues Packages Projects Releases Wiki Activity

Update RUSTSEC-2023-0042 to reflect patch. (#1717)

Browse Source
This commit is contained in:
joshua-maros
2023-06-15 04:07:09 -07:00
committed by GitHub
parent 13b9455e9f
commit 37abf6e463
1 changed files with 5 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
crates/ouroboros/RUSTSEC-2023-0042.md
View File

@@ -7,20 +7,18 @@ url = "https://github.com/joshua-maros/ouroboros/issues/88"
informational = "unsound"
[versions]
patched = []
patched = [">=0.16.0"]
```
# Ouroboros is Unsound
## Summary
Ouroboros has a soundness problem. A fix was attempted but
unsuccessful, leaving the crate unmaintained. Migrate code to use
[self_cell](https://github.com/Voultapher/self_cell) instead.
Ouroboros has a soundness problem, but a fix has been implemented in 0.16.0.
## More details:
Currently, Ouroboros works internally by creating a struct where all
In 0.15.0, Ouroboros works internally by creating a struct where all
uses of 'this are replaced by 'static. However, a recent addition to
Miri checks that references passed to functions are valid during the
entire execution of the function, even when those references are
@@ -46,6 +44,5 @@ which, this fix does not allow for template or constant parameters
as there is no way to check the size of a templated type without
giving specific, concrete values for the template parameters.
The crate at this point is no longer maintained, and previous
users should migrate their code to use
[self_cell](https://github.com/Voultapher/self_cell) instead.
The final solution was to use this fix while wrapping the raw byte
array in `MaybeUninit<>`.