mirror of
https://github.com/rustsec/advisory-db.git
synced 2025-12-27 01:54:07 -05:00
Add advisory for double-free in insert_many
This commit is contained in:
21
crates/insert_many/RUSTSEC-0000-0000.md
Normal file
21
crates/insert_many/RUSTSEC-0000-0000.md
Normal file
@@ -0,0 +1,21 @@
|
||||
```toml
|
||||
[advisory]
|
||||
id = "RUSTSEC-0000-0000"
|
||||
package = "insert_many"
|
||||
date = "2021-01-26"
|
||||
url = "https://github.com/rphmeier/insert_many/issues/1"
|
||||
categories = ["memory-corruption"]
|
||||
keywords = ["memory-safety", "double-free"]
|
||||
|
||||
[versions]
|
||||
patched = []
|
||||
```
|
||||
|
||||
# insert_many can drop elements twice on panic
|
||||
|
||||
Affected versions of `insert_many` used `ptr::copy` to move over items in a
|
||||
vector to make space before inserting, duplicating their ownership. It then
|
||||
iterated over a provided `Iterator` to insert the new items.
|
||||
|
||||
If the iterator's `.next()` method panics then the vector would drop the same
|
||||
elements twice.
|
||||
Reference in New Issue
Block a user