Commits on Jun 7, 2022

1. bug: update crossbeam-channel …

   Impact
   The affected version of this crate's the bounded channel incorrectly assumes that Vec::from_iter has allocated capacity that same as the number of iterator elements. Vec::from_iter does not actually guarantee that and may allocate extra memory. The destructor of the bounded channel reconstructs Vec from the raw pointer based on the incorrect assumes described above. This is unsound and causing deallocation with the incorrect capacity when Vec::from_iter has allocated different sizes with the number of iterator elements.
   
   Patches
   This has been fixed in crossbeam-channel 0.4.4.
   
   We recommend users to upgrade to 0.4.4.
   
   References
   See crossbeam-rs/crossbeam#533, crossbeam-rs/crossbeam#539, and rustsec/advisory-db#425 for more details.

   

   CjS77 committed Jun 7, 2022
   Configuration menu

   • View commit details
   • Copy full SHA for eaa8b1a
   • Browse repository at this point

   Copy the full SHA

   eaa8b1a View commit details

   Browse the repository at this point in the history