GitHub Advisoryadvisory · crates.io
GHSA-48m6-wm5p-rr6h Insufficient covariance check makes self_cell unsound
HIGH
Official page ↗
- Ecosystem
- crates.io
- Packages
- self_cell
- Severity
- High
- Reviewed
- 2023-11-14
Affected packages
• crates.io self_cell: < 0.10.3 → fixed in 0.10.3
• crates.io self_cell: >= 1.0.0, < 1.0.2 → fixed in 1.0.2
Description
All public versions prior to `1.02` used an insufficient check to ensure that users correctly marked the dependent type as either `covariant` or `not_covariant`. This allowed users to mark a dependent as covariant even though its type was not covariant but invariant, for certain invariant types involving trait object lifetimes. One example for such a dependent type is `type Dependent = RefCell>`. Such a type allowed unsound usage in purely safe user code that leads to undefined behavior. The patched versions now produce a compile time error if such a type is marked as `covariant`.