diff --git a/crates/id-map/RUSTSEC-0000-0000.md b/crates/id-map/RUSTSEC-0000-0000.md new file mode 100644 index 0000000..97789cd --- /dev/null +++ b/crates/id-map/RUSTSEC-0000-0000.md @@ -0,0 +1,34 @@ +```toml +[advisory] +id = "RUSTSEC-0000-0000" +package = "id-map" +date = "2021-02-26" +url = "https://github.com/andrewhickman/id-map/issues/3" +categories = ["memory-corruption"] +keywords = ["memory-safety", "double-free"] + +[versions] +patched = [] +``` + +# Multiple functions can cause double-frees + +The following functions in the crate are affected: + +## `IdMap::clone_from` + +The `clone_from` implementation for `IdMap` drops the values present in the +map and then begins cloning values from the other map. If a `.clone()` call +pancics, then the afformentioned dropped elements can be freed again. + +## `get_or_insert` + +`get_or_insert` reserves space for a value, before calling the user provided +insertion function `f`. If the function `f` panics then uninitialized or +previously freed memory can be dropped. + +## `remove_set` + +When removing a set of elements, `ptr::drop_in_place` is called on each of the +element to be removed. If the `Drop` impl of one of these elements panics then +the previously dropped elements can be dropped again.