From 7a48c26392c6e31c4a3336ec573f8d49291f558c Mon Sep 17 00:00:00 2001 From: Ammar Askar Date: Mon, 29 Mar 2021 13:10:43 -0700 Subject: [PATCH] Report double-free in through crate --- crates/through/RUSTSEC-0000-0000.md | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) create mode 100644 crates/through/RUSTSEC-0000-0000.md diff --git a/crates/through/RUSTSEC-0000-0000.md b/crates/through/RUSTSEC-0000-0000.md new file mode 100644 index 000000000..948d95fa9 --- /dev/null +++ b/crates/through/RUSTSEC-0000-0000.md @@ -0,0 +1,22 @@ +```toml +[advisory] +id = "RUSTSEC-0000-0000" +package = "through" +date = "2021-02-18" +url = "https://github.com/gretchenfrage/through/issues/1" +categories = ["memory-corruption"] +keywords = ["memory-safety", "double-free"] + +[versions] +patched = [] +``` + +# `through` and `through_and` causes a double free if the map function panics + +`through` and `through_and` take a mutable reference as well as a mapping +function to change the provided reference. They do this by calling `ptr::read` +on the reference which duplicates ownership and then calling the mapping +function. + +If the mapping function panics, both the original object and the one +duplicated by `ptr::read` get dropped, causing a double free.