diff --git a/crates/qwutils/RUSTSEC-0000-0000.md b/crates/qwutils/RUSTSEC-0000-0000.md new file mode 100644 index 000000000..972cb7e83 --- /dev/null +++ b/crates/qwutils/RUSTSEC-0000-0000.md @@ -0,0 +1,26 @@ +```toml +[advisory] +id = "RUSTSEC-0000-0000" +package = "qwutils" +date = "2021-02-03" +url = "https://github.com/qwertz19281/rust_utils/issues/3" +categories = ["memory-corruption"] +keywords = ["memory-safety", "double-free"] + +[versions] +patched = [">= 0.3.1"] + +[affected] +functions = { "qwutils::imp::vec::VecExt::insert_slice_clone" = ["< 0.3.1"] } +``` + +# insert_slice_clone can double drop if Clone panics. + +Affected versions of this crate used `ptr::copy` when inserting into the middle +of a `Vec`. When ownership was temporarily duplicated during this copy, it calls +the clone method of a user provided element. + +This issue can result in an element being double-freed if the clone call panics. + +Commit `20cb73d` fixed this issue by adding a `set_len(0)` call before +operating on the vector to avoid dropping the elements during a panic.