Skip to content

Commit bf2e059

Browse files
authored
add crossbeam advisories for incorrect (unsound) zeroed memory (#1231)
* add crossbeam queue advisory * also add crossbeam-channel issue
1 parent 7975ad6 commit bf2e059

File tree

3 files changed

+54
-0
lines changed

3 files changed

+54
-0
lines changed
Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
```toml
2+
[advisory]
3+
id = "RUSTSEC-0000-0000"
4+
package = "crossbeam-channel"
5+
date = "2022-05-10"
6+
informational = "unsound"
7+
url = "https://github.com/crossbeam-rs/crossbeam/pull/458"
8+
9+
[versions]
10+
patched = [">= 0.4.3"]
11+
```
12+
13+
# Channel creates zero value of any type
14+
15+
Affected versions of this crate called `mem::zeroed()` to create values of a user-supplied type `T`.
16+
This is unsound e.g. if `T` is a reference type (which must be non-null).
17+
18+
The flaw was corrected by avoiding the use of `mem::zeroed()`, using `MaybeUninit` instead.
Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
```toml
2+
[advisory]
3+
id = "RUSTSEC-0000-0000"
4+
package = "crossbeam-queue"
5+
date = "2022-05-10"
6+
informational = "unsound"
7+
url = "https://github.com/crossbeam-rs/crossbeam/pull/458"
8+
9+
[versions]
10+
patched = [">= 0.2.3"]
11+
```
12+
13+
# `SegQueue` creates zero value of any type
14+
15+
Affected versions of this crate called `mem::zeroed()` to create values of a user-supplied type `T`.
16+
This is unsound e.g. if `T` is a reference type (which must be non-null).
17+
18+
The flaw was corrected by avoiding the use of `mem::zeroed()`, using `MaybeUninit` instead.

crates/crossbeam/RUSTSEC-0000-0000.md

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
```toml
2+
[advisory]
3+
id = "RUSTSEC-0000-0000"
4+
package = "crossbeam"
5+
date = "2022-05-10"
6+
informational = "unsound"
7+
url = "https://github.com/crossbeam-rs/crossbeam/pull/458"
8+
9+
[versions]
10+
patched = [">= 0.7.0"]
11+
```
12+
13+
# `SegQueue` creates zero value of any type
14+
15+
Affected versions of this crate called `mem::zeroed()` to create values of a user-supplied type `T`.
16+
This is unsound e.g. if `T` is a reference type (which must be non-null).
17+
18+
The flaw was corrected by avoiding the use of `mem::zeroed()`, using `MaybeUninit` instead.

0 commit comments

Comments
 (0)