From 727cea2410cb9805af36d57dd32f36423b01ae71 Mon Sep 17 00:00:00 2001 From: Ammar Askar Date: Mon, 29 Mar 2021 08:57:15 -0700 Subject: [PATCH] Report double-free in slice-deque --- crates/slice-deque/RUSTSEC-0000-0000.md | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) create mode 100644 crates/slice-deque/RUSTSEC-0000-0000.md diff --git a/crates/slice-deque/RUSTSEC-0000-0000.md b/crates/slice-deque/RUSTSEC-0000-0000.md new file mode 100644 index 0000000..df6af30 --- /dev/null +++ b/crates/slice-deque/RUSTSEC-0000-0000.md @@ -0,0 +1,20 @@ +```toml +[advisory] +id = "RUSTSEC-0000-0000" +package = "slice-deque" +date = "2021-02-19" +url = "https://github.com/gnzlbg/slice_deque/issues/90" +categories = ["memory-corruption"] +keywords = ["memory-safety", "double-free"] + +[versions] +patched = [] +``` + +# SliceDeque::drain_filter can double drop an element if the predicate panics + +Affected versions of the crate incremented the current index of the drain filter +iterator *before* calling the predicate function `self.pred`. + +If the predicate function panics, it is possible for the last element in the +iterator to be dropped twice.