From 6145339aac83b9a1f1c12dd5a5bb7a60bc27b31b Mon Sep 17 00:00:00 2001 From: Shihao Xia Date: Tue, 6 May 2025 16:18:24 -0400 Subject: [PATCH] anon-vec: insufficient checks in public API --- crates/anon-vec/RUSTSEC-0000-0000.md | 29 ++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) create mode 100644 crates/anon-vec/RUSTSEC-0000-0000.md diff --git a/crates/anon-vec/RUSTSEC-0000-0000.md b/crates/anon-vec/RUSTSEC-0000-0000.md new file mode 100644 index 000000000..1398cc542 --- /dev/null +++ b/crates/anon-vec/RUSTSEC-0000-0000.md @@ -0,0 +1,29 @@ +```toml +[advisory] +id = "RUSTSEC-0000-0000" +package = "anon-vec" +date = "2025-05-06" +informational = "unsound" +url = "https://github.com/RylanYancey/anon-vec" +categories = ["memory-corruption"] + +[affected.functions] +"anon_vec::AnonVec::get_ref" = ["<= 0.1.1"] +"anon_vec::AnonVec::get_mut" = ["<= 0.1.1"] +"anon_vec::AnonVec::remove_get" = ["<= 0.1.1"] + +[versions] +patched = [] +unaffected = [] +``` + +# Lack of sufficient checks in public API + +The following functions in the anon-vec crate are unsound due to insufficient checks on their +arguments:: + +- `AnonVec::get_ref()` +- `AnonVec::get_mut()` +- `AnonVec::remove_get()` + +The crate was built as a learning project and is not being maintained.