Skip to content

Commit

Permalink
Merge pull request #832 from ammaraskar/insert_many
Browse files Browse the repository at this point in the history
Add advisory for double-free in insert_many
  • Loading branch information
Shnatsel authored Mar 26, 2021
2 parents 3ddeb5c + c742f10 commit a1aa708
Showing 1 changed file with 21 additions and 0 deletions.
21 changes: 21 additions & 0 deletions crates/insert_many/RUSTSEC-0000-0000.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,21 @@
```toml
[advisory]
id = "RUSTSEC-0000-0000"
package = "insert_many"
date = "2021-01-26"
url = "https://github.com/rphmeier/insert_many/issues/1"
categories = ["memory-corruption"]
keywords = ["memory-safety", "double-free"]

[versions]
patched = []
```

# insert_many can drop elements twice on panic

Affected versions of `insert_many` used `ptr::copy` to move over items in a
vector to make space before inserting, duplicating their ownership. It then
iterated over a provided `Iterator` to insert the new items.

If the iterator's `.next()` method panics then the vector would drop the same
elements twice.

0 comments on commit a1aa708

Please sign in to comment.