GHSA-f9g6-fp84-fv92

Suggest an improvement
Source
https://github.com/advisories/GHSA-f9g6-fp84-fv92
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/07/GHSA-f9g6-fp84-fv92/GHSA-f9g6-fp84-fv92.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-f9g6-fp84-fv92
Aliases
Published
2023-07-19T22:09:38Z
Modified
2023-11-08T04:18:55.242781Z
Summary
impl `FromMdbValue` for bool is unsound
Details

The implementation of FromMdbValue has several unsoundness issues. First of all, it allows to reinterpret arbitrary bytes as a bool and could make undefined behavior happen with safe function. Secondly, it allows transmuting pointer without taking memory layout into consideration. The details of reproducing the bug are available here.

Database specific 
{
    "github_reviewed": true,
    "nvd_published_at": null,
    "github_reviewed_at": "2023-07-19T22:09:38Z",
    "severity": "MODERATE",
    "cwe_ids": []
}
References

Affected packages

crates.io / lmdb-rs

Package

Name
lmdb-rs
View open source insights on deps.dev
Purl
pkg:cargo/lmdb-rs

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Last affected
0.7.6