Affected versions of this crate used ptr::copy when inserting into the middle of a Vec. When ownership was temporarily duplicated during this copy, it calls the clone method of a user provided element.
This issue can result in an element being double-freed if the clone call panics.
Commit 20cb73d
fixed this issue by adding a set_len(0) call before operating on the vector to avoid dropping the elements during a panic.
{ "nvd_published_at": "2021-02-09T23:15:00Z", "cwe_ids": [ "CWE-415" ], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2022-06-17T00:14:33Z" }