diff --git a/crates/flatbuffers/RUSTSEC-0000-0000.toml b/crates/flatbuffers/RUSTSEC-0000-0000.toml new file mode 100644 index 0000000..cdf5a85 --- /dev/null +++ b/crates/flatbuffers/RUSTSEC-0000-0000.toml @@ -0,0 +1,31 @@ +[advisory] +id = "RUSTSEC-0000-0000" +package = "flatbuffers" +date = "2020-04-11" +title = "`read_scalar` and `read_scalar_at` are unsound`" +url = "https://github.com/google/flatbuffers/issues/5825" +description = """ +The `read_scalar` and `read_scalar_at` functions are unsound +because the allow transmuting values without `unsafe` blocks. + +The following example shows how to create a dangling reference: + +``` +fn main() { + #[derive(Copy, Clone, PartialEq, Debug)] + struct S(&'static str); + impl flatbuffers::EndianScalar for S { + fn to_little_endian(self) -> Self { self } + fn from_little_endian(self) -> Self { self } + } + println!("{:?}", flatbuffers::read_scalar::(&[1; std::mem::size_of::()])); +} +``` +""" + +[affected.functions] +"flatbuffers::read_scalar" = [] +"flatbuffers::read_scalar_at" = [] + +[versions] +patched = []