From f35600e723ee17f2af7ea4dd789a560336cc4fa4 Mon Sep 17 00:00:00 2001 From: Ammar Askar Date: Wed, 31 Mar 2021 07:59:21 -0700 Subject: [PATCH] Add advisory for double-free issues in id-map --- crates/id-map/RUSTSEC-0000-0000.md | 34 ++++++++++++++++++++++++++++++ 1 file changed, 34 insertions(+) create mode 100644 crates/id-map/RUSTSEC-0000-0000.md diff --git a/crates/id-map/RUSTSEC-0000-0000.md b/crates/id-map/RUSTSEC-0000-0000.md new file mode 100644 index 0000000..97789cd --- /dev/null +++ b/crates/id-map/RUSTSEC-0000-0000.md @@ -0,0 +1,34 @@ +```toml +[advisory] +id = "RUSTSEC-0000-0000" +package = "id-map" +date = "2021-02-26" +url = "https://github.com/andrewhickman/id-map/issues/3" +categories = ["memory-corruption"] +keywords = ["memory-safety", "double-free"] + +[versions] +patched = [] +``` + +# Multiple functions can cause double-frees + +The following functions in the crate are affected: + +## `IdMap::clone_from` + +The `clone_from` implementation for `IdMap` drops the values present in the +map and then begins cloning values from the other map. If a `.clone()` call +pancics, then the afformentioned dropped elements can be freed again. + +## `get_or_insert` + +`get_or_insert` reserves space for a value, before calling the user provided +insertion function `f`. If the function `f` panics then uninitialized or +previously freed memory can be dropped. + +## `remove_set` + +When removing a set of elements, `ptr::drop_in_place` is called on each of the +element to be removed. If the `Drop` impl of one of these elements panics then +the previously dropped elements can be dropped again.