GitHub Advisoryadvisory · crates.io
GHSA-2326-pfpj-vx3h lexical-core has multiple soundness issues
LOW
Official page ↗
- Ecosystem
- crates.io
- Packages
- lexical-core
- Severity
- Low
- Reviewed
- 2024-09-16
Affected packages
• crates.io lexical-core: < 1.0.0 → fixed in 1.0.0
Description
`RUSTSEC-2024-0377` contains multiple soundness issues:
1. Bytes::read() allows creating instances of types with invalid bit patterns
1. BytesIter::read() advances iterators out of bounds
1. The `BytesIter` trait has safety invariants but is public and not marked `unsafe`
1. `write_float()` calls `MaybeUninit::assume_init()` on uninitialized data, which is is not allowed by the Rust abstract machine
1. `radix()` calls `MaybeUninit::assume_init()` on uninitialized data, which is is not allowed by the Rust abstract machine
Version 1.0 fixes these issues, removes the vast majority of `unsafe` code, and also fixes some correctness issues.
References
- https://github.com/Alexhuszagh/rust-lexical/issues/101 web
- https://github.com/Alexhuszagh/rust-lexical/issues/102 web
- https://github.com/Alexhuszagh/rust-lexical/issues/104 web
- https://github.com/Alexhuszagh/rust-lexical/issues/126 web
- https://github.com/Alexhuszagh/rust-lexical/issues/95 web
- https://github.com/Alexhuszagh/rust-lexical package
- https://github.com/advisories/GHSA-c2hm-mjxv-89r4 advisory
- https://rustsec.org/advisories/RUSTSEC-2023-0055 web
- https://rustsec.org/advisories/RUSTSEC-2023-0086.html web