diff --git a/crates/ouroboros/RUSTSEC-2023-0042.md b/crates/ouroboros/RUSTSEC-2023-0042.md index 5e88c8c..1205ca8 100644 --- a/crates/ouroboros/RUSTSEC-2023-0042.md +++ b/crates/ouroboros/RUSTSEC-2023-0042.md @@ -7,20 +7,18 @@ url = "https://github.com/joshua-maros/ouroboros/issues/88" informational = "unsound" [versions] -patched = [] +patched = [">=0.16.0"] ``` # Ouroboros is Unsound ## Summary -Ouroboros has a soundness problem. A fix was attempted but -unsuccessful, leaving the crate unmaintained. Migrate code to use -[self_cell](https://github.com/Voultapher/self_cell) instead. +Ouroboros has a soundness problem, but a fix has been implemented in 0.16.0. ## More details: -Currently, Ouroboros works internally by creating a struct where all +In 0.15.0, Ouroboros works internally by creating a struct where all uses of 'this are replaced by 'static. However, a recent addition to Miri checks that references passed to functions are valid during the entire execution of the function, even when those references are @@ -46,6 +44,5 @@ which, this fix does not allow for template or constant parameters as there is no way to check the size of a templated type without giving specific, concrete values for the template parameters. -The crate at this point is no longer maintained, and previous -users should migrate their code to use -[self_cell](https://github.com/Voultapher/self_cell) instead. +The final solution was to use this fix while wrapping the raw byte +array in `MaybeUninit<>`.