qwertz19281/rust_utils · Security
insert_slice_clone can double drop if Clone panics.
- GHSA ID
- GHSA-68p4-pjpf-xwcq
- CVE ID
- CVE-2021-26954
- Severity
- medium
- Published
- Updated
- CVSS
- 5.3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- CVSS v3
- 5.3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Description
Affected versions of this crate used ptr::copy when inserting into the middle of a Vec. When ownership was temporarily duplicated during this copy, it calls the clone method of a user provided element.
This issue can result in an element being double-freed if the clone call panics.
Commit 20cb73d fixed this issue by adding a set_len(0) call before operating on the vector to avoid dropping the elements during a panic.
CWEs
- CWE-415 · Double Free