advisory-db/crates/simple-slab/RUSTSEC-2020-0039.md

[advisory]
id = "RUSTSEC-2020-0039"
package = "simple-slab"
aliases = ["CVE-2020-35892", "CVE-2020-35893"]
date = "2020-09-03"
url = "https://github.com/nathansizemore/simple-slab/issues/2"

[versions]
patched = [">= 0.3.3"]

index() allows out-of-bound read and remove() has off-by-one error

Slab::index() does not perform the boundary checking, which leads to out-of-bound read access. Slab::remove() copies an element from an invalid address due to off-by-one error, resulting in memory leakage and uninitialized memory drop.