Merge pull request #846 from ammaraskar/slice-deque

Report double-free in slice-deque
This commit is contained in:
Sergey "Shnatsel" Davidoff
2021-03-30 04:19:36 +02:00
committed by GitHub

View File

@@ -0,0 +1,20 @@
```toml
[advisory]
id = "RUSTSEC-0000-0000"
package = "slice-deque"
date = "2021-02-19"
url = "https://github.com/gnzlbg/slice_deque/issues/90"
categories = ["memory-corruption"]
keywords = ["memory-safety", "double-free"]
[versions]
patched = []
```
# SliceDeque::drain_filter can double drop an element if the predicate panics
Affected versions of the crate incremented the current index of the drain filter
iterator *before* calling the predicate function `self.pred`.
If the predicate function panics, it is possible for the last element in the
iterator to be dropped twice.