GHSA-gfgm-chr3-x6px
Suggest an improvement- Source
- https://github.com/advisories/GHSA-gfgm-chr3-x6px
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/12/GHSA-gfgm-chr3-x6px/GHSA-gfgm-chr3-x6px.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-gfgm-chr3-x6px
- Aliases
- Published
- 2022-12-30T17:48:30Z
- Modified
- 2023-11-08T04:19:29Z
- Summary
- prettytable-rs: Force cast a &Vec<T> to &[T] may lead to undefined behavior
- Details
-
In function
Table::as_ref, a reference of vector is force cast to slice. There are multiple problems here:- To guarantee the size is correct, we have to first do
Vec::shrink_to_fit. The function requires a mutable reference, so we have to force cast from immutable to mutable, which is undefined behavior (UB). - Even if (1) is sound,
&Vec<T>and&[T]still might not have the same layout. Treating them equally may lead to undefinted behavior (UB).
- To guarantee the size is correct, we have to first do
- Database specific
{ "cwe_ids": [], "github_reviewed": true, "github_reviewed_at": "2022-12-30T17:48:30Z", "nvd_published_at": null, "severity": "MODERATE" }- References
Affected packages
crates.io / prettytable-rs
Package
- Name
- prettytable-rs
- View open source insights on deps.dev
- Purl
- pkg:cargo/prettytable-rs