GHSA-gfgm-chr3-x6px

Suggest an improvement
Source
https://github.com/advisories/GHSA-gfgm-chr3-x6px
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/12/GHSA-gfgm-chr3-x6px/GHSA-gfgm-chr3-x6px.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-gfgm-chr3-x6px
Aliases
Published
2022-12-30T17:48:30Z
Modified
2023-11-08T04:19:29.041635Z
Summary
prettytable-rs: Force cast a &Vec<T> to &[T] may lead to undefined behavior
Details

In function Table::as_ref, a reference of vector is force cast to slice. There are multiple problems here: 1. To guarantee the size is correct, we have to first do Vec::shrink_to_fit. The function requires a mutable reference, so we have to force cast from immutable to mutable, which is undefined behavior (UB). 2. Even if (1) is sound, &Vec<T> and &[T] still might not have the same layout. Treating them equally may lead to undefinted behavior (UB).

Database specific
{
    "nvd_published_at": null,
    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2022-12-30T17:48:30Z"
}
References

Affected packages

crates.io / prettytable-rs

Package

Name
prettytable-rs
View open source insights on deps.dev
Purl
pkg:cargo/prettytable-rs

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.10.0