From a0c9d676d4b71b6e1450f33fb12627c5c9b0bd39 Mon Sep 17 00:00:00 2001 From: Ammar Askar Date: Wed, 3 Mar 2021 06:36:09 -0800 Subject: [PATCH] Add advisory for double-free in stack_dst --- crates/stack_dst/RUSTSEC-0000-0000.md | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) create mode 100644 crates/stack_dst/RUSTSEC-0000-0000.md diff --git a/crates/stack_dst/RUSTSEC-0000-0000.md b/crates/stack_dst/RUSTSEC-0000-0000.md new file mode 100644 index 0000000..1d1d8a5 --- /dev/null +++ b/crates/stack_dst/RUSTSEC-0000-0000.md @@ -0,0 +1,26 @@ +```toml +[advisory] +id = "RUSTSEC-0000-0000" +package = "stack_dst" +date = "2021-02-22" +url = "https://github.com/thepowersgang/stack_dst-rs/issues/5" +categories = ["memory-corruption"] +keywords = ["memory-safety", "double-free"] + +[versions] +patched = [">= 0.6.1"] + +[affected] +functions = { "stack_dst::StackA::push_cloned" = ["< 0.6.1"] } +``` + +# push_cloned can drop uninitialized memory or double free on panic + +Affected versions of `stack_dst` used a `push_inner` function that increased +the internal length of the array and then called `val.clone()`. + +If the `val.clone()` call panics, the stack could drop an already dropped +element or drop uninitialized memory. + +This issue was fixed in `2a4d538` by increasing the length of the array after +elements are cloned.