OMGeeky/advisory-db
1
0
Fork 0
mirror of https://github.com/OMGeeky/advisory-db.git synced 2025-12-30 08:13:58 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #460 from BlackHoleFox/futures-util-futuresunordered-badsync

Browse Source 
Add advisory for unsound Sync impl on FuturesUnordered in futures-util
This commit is contained in:
Sergey "Shnatsel" Davidoff
2020-10-31 14:16:33 +01:00
committed by GitHub
parent aed943c2d1 47bfd9f2a4
commit 529c111e43
1 changed files with 25 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
crates/futures-util/RUSTSEC-0000-0000.md Normal file
View File

@@ -0,0 +1,25 @@
```toml
[advisory]
id = "RUSTSEC-0000-0000"
package = "futures-util"
date = "2020-01-24"
url = "https://github.com/rust-lang/futures-rs/issues/2050"
categories = ["memory-corruption"]
keywords = ["concurrency", "memory-corruption", "memory-management"]
[affected]
functions = { "futures_util::stream::FuturesUnordered" = [">= 0.3.0"] }
[versions]
patched = [">= 0.3.2"]
unaffected = ["< 0.3.0"]
```
# Improper `Sync` implementation on `FuturesUnordered` in futures-utils can cause data corruption
Affected versions of the crate had an unsound `Sync` implementation on the `FuturesUnordered` structure, which used a `Cell` for
interior mutablity without any code to handle synchronized access to the underlying task list's length and head safely.
This could of lead to data corruption since two threads modifying the list at once could see incorrect values due to the lack
of access synchronization.
The issue was fixed by adding access synchronization code around insertion of tasks into the list.