OMGeeky/advisory-db
1
0
Fork 0
mirror of https://github.com/OMGeeky/advisory-db.git synced 2026-01-03 10:05:26 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #600 from JOE1994/eventio

Browse Source 
eventio: Input<R>' can send non-Send types to other threads
This commit is contained in:
Sergey "Shnatsel" Davidoff
2021-01-20 20:23:08 +01:00
committed by GitHub
parent e60666e1bc 77017364db
commit 86729f4ca9
1 changed files with 20 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
crates/eventio/RUSTSEC-0000-0000.md Normal file
View File

@@ -0,0 +1,20 @@
```toml
[advisory]
id = "RUSTSEC-0000-0000"
package = "eventio"
date = "2020-12-20"
url = "https://github.com/petabi/eventio/issues/33"
categories = ["memory-corruption"]
[versions]
patched = [">= 0.5.1"]
```
# Soundness issue: Input<R> can be misused to create data race to an object
`Input<R>` implements `Send` without requiring `R: Send`.
Affected versions of this crate allows users to send non-Send types to other threads,
which can lead to undefined behavior such as data race and memory corruption.
The flaw was corrected in version 0.5.1 by adding `R: Send` bound to the `Send` impl of `Input<R>`.