diff --git a/crates/net2/RUSTSEC-0000-0000.md b/crates/net2/RUSTSEC-0000-0000.md index 04bbf74..d35a022 100644 --- a/crates/net2/RUSTSEC-0000-0000.md +++ b/crates/net2/RUSTSEC-0000-0000.md @@ -12,10 +12,13 @@ patched = [">= 0.2.36"] # `net2` invalidly assumes the memory layout of std::net::SocketAddr -The [`net2`](https://crates.io/crates/net2) crate has converted `std::net::SocketAddr` -instances into C `sockaddr` pointers simply by casting the pointer. This will cause -invalid memory access if/when the standard library ever changes the implementation. -No warnings or errors will be emitted once the change happens. +The [`net2`](https://crates.io/crates/net2) crate has assumed `std::net::SocketAddrV4` +and `std::net::SocketAddrV6` have the same memory layout as the system C representation +`sockaddr`. It has simply casted the pointers to convert the socket addresess to the +system representation. The standard library does not say anything about the memory +layout, and this will cause invalid memory access if the standard library +changes the implementation. No warnings or errors will be emitted once the +change happens. -Please stop using `net2` completely (it's deprecated, use `socket2`) or at least +Please stop using `net2` completely (it is deprecated, use `socket2`) or at least upgrade to version `0.2.36` where the socket address conversion is done safely. \ No newline at end of file