diff --git a/crates/lmdb-rs/RUSTSEC-0000-0000.md b/crates/lmdb-rs/RUSTSEC-0000-0000.md new file mode 100644 index 0000000..f1cdee4 --- /dev/null +++ b/crates/lmdb-rs/RUSTSEC-0000-0000.md @@ -0,0 +1,15 @@ +```toml +[advisory] +id = "RUSTSEC-0000-0000" +package = "lmdb-rs" +date = "2023-06-26" +informational = "unsound" +url = "https://github.com/vhbit/lmdb-rs/issues/67" +keywords = ["unsound"] + +[versions] +patched = [] +``` + +# impl `FromMdbValue` for bool is unsound +The implementation of `FromMdbValue` have several unsoundness issues. First of all, it allows to reinterpret arbitrary bytes as a bool and could make undefined behavior happen with safe function. Secondly, it allows transmuting pointer without taking memory layout into consideration. The details of reproducing the bug were included in url above.