RUSTSEC-2020-0009: `read_scalar` and `read_scalar_at` allow transmuting values without `unsafe` blocks
Opened this issue · 0 comments
github-actions commented
read_scalar
andread_scalar_at
allow transmuting values withoutunsafe
blocks
Details | |
---|---|
Package | flatbuffers |
Version | 0.6.1 |
URL | google/flatbuffers#5825 |
Date | 2020-04-11 |
Unaffected versions | < 0.4.0 |
The read_scalar
and read_scalar_at
functions are unsound
because they allow transmuting values without unsafe
blocks.
The following example shows how to create a dangling reference:
fn main() {
#[derive(Copy, Clone, PartialEq, Debug)]
struct S(&'static str);
impl flatbuffers::EndianScalar for S {
fn to_little_endian(self) -> Self { self }
fn from_little_endian(self) -> Self { self }
}
println!("{:?}", flatbuffers::read_scalar::<S>(&[1; std::mem::size_of::<S>()]));
}
See advisory page for additional details.