From e75cf0ff80dad431308f421b43eebfd6c03bc227 Mon Sep 17 00:00:00 2001 From: Manish Goregaokar Date: Mon, 8 Jul 2024 17:03:51 +0000 Subject: [PATCH] Fix patched zerovec-derive version We accidentally proposed the wrong version here. zerovec 0.10.4 and zerovec-derive 0.10.3 are patched. --- crates/zerovec-derive/RUSTSEC-2024-0346.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/crates/zerovec-derive/RUSTSEC-2024-0346.md b/crates/zerovec-derive/RUSTSEC-2024-0346.md index 99220cc1a..48f302eb3 100644 --- a/crates/zerovec-derive/RUSTSEC-2024-0346.md +++ b/crates/zerovec-derive/RUSTSEC-2024-0346.md @@ -6,7 +6,7 @@ date = "2024-07-01" categories = ["memory-corruption"] [versions] -patched = [">= 0.10.4", ">= 0.9.7, <0.10.0"] +patched = [">= 0.10.3", ">= 0.9.7, <0.10.0"] ``` # Incorrect usage of `#[repr(packed)]` @@ -16,4 +16,4 @@ The affected versions make unsafe memory accesses under the assumption that `#[r The Rust specification does not guarantee this, and https://github.com/rust-lang/rust/pull/125360 (1.80.0-beta) starts reordering fields of `#[repr(packed)]` structs, leading to illegal memory accesses. -The patched versions `0.9.7` and `0.10.4` use `#[repr(C, packed)]`, which guarantees field order. +The patched versions `0.9.7` and `0.10.3` use `#[repr(C, packed)]`, which guarantees field order.