GHSA-wm8x-php5-hvq6

Suggest an improvement
Source
https://github.com/advisories/GHSA-wm8x-php5-hvq6
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/03/GHSA-wm8x-php5-hvq6/GHSA-wm8x-php5-hvq6.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-wm8x-php5-hvq6
Aliases
Published
2023-03-07T20:13:19Z
Modified
2023-11-08T04:23:53.984745Z
Summary
Maligned causes incorrect deallocation
Details

maligned::align_first manually allocates with an alignment larger than T, and then uses Vec::from_raw_parts on that allocation to get a Vec<T>.

GlobalAlloc::dealloc requires that the layout argument must be the same layout that was used to allocate that block of memory.

When deallocating, Box and Vec may not respect the specified alignment and can cause undefined behavior.

Database specific 
{
    "nvd_published_at": null,
    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2023-03-07T20:13:19Z"
}
References

Affected packages

crates.io / maligned

Package

Name
maligned
View open source insights on deps.dev
Purl
pkg:cargo/maligned

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Last affected
0.2.1