From c742f10bbdaeb8af22c33d0d598e6d968e4b1bbe Mon Sep 17 00:00:00 2001 From: Ammar Askar Date: Thu, 25 Mar 2021 22:57:00 -0700 Subject: [PATCH] Add advisory for double-free in insert_many --- crates/insert_many/RUSTSEC-0000-0000.md | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) create mode 100644 crates/insert_many/RUSTSEC-0000-0000.md diff --git a/crates/insert_many/RUSTSEC-0000-0000.md b/crates/insert_many/RUSTSEC-0000-0000.md new file mode 100644 index 0000000..b138286 --- /dev/null +++ b/crates/insert_many/RUSTSEC-0000-0000.md @@ -0,0 +1,21 @@ +```toml +[advisory] +id = "RUSTSEC-0000-0000" +package = "insert_many" +date = "2021-01-26" +url = "https://github.com/rphmeier/insert_many/issues/1" +categories = ["memory-corruption"] +keywords = ["memory-safety", "double-free"] + +[versions] +patched = [] +``` + +# insert_many can drop elements twice on panic + +Affected versions of `insert_many` used `ptr::copy` to move over items in a +vector to make space before inserting, duplicating their ownership. It then +iterated over a provided `Iterator` to insert the new items. + +If the iterator's `.next()` method panics then the vector would drop the same +elements twice.